Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: How to change indexes in Splunk Add-on for VMw...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This isn't an option through the UI of the application. How do you change the indexes where the data is flowing to?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Kendo213,
You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf
http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS
For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Kendo213,
You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf
http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS
For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This doesn't seem to be the case with the Splunk Add-on for Vmware.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would you mind providing the name of the index you want to change? It will be easy for us then to point to the app and file
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The sourcetypes are coming in as vmware:perf:*
The index is vmware:perf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try changing the index in splunk-add-on-for-vmware_342\splunk-add-on-for-vmware_342\Splunk_TA_vmware\default\ta_vmware_collection.conf
Reference : https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference
What goes around comes around. If it helps, hit it with Karma 🙂
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
