Specifying the index for a new stream

[_smp_]

I am kicking the tires of the Splunk Stream app v7.10 on my v6.5.3 distributed deployment. I want this data to go into an index named 'sandbox' which is only available on my Indexer. But when I create a new stream and am at the point where I must select an index, the only indexes I see are the ones on the SH. Did I mis-configure something?

[DenM]

Hello yes you can.

I use this technique to put my streams in different indexes and manage the permissions.

You need to declare the index on your Splunk stream app indexes.conf. to do that follow this steps:

1) On your stream server : SPLUNK_HOME/etc/apps/splunk_app_stream/local
2) edit or create the indexes.conf file
3) declare your indexes (already created on your indexers) like this
[yourindex]
coldpath = $SPLUNK_DB/yourindex/colddb
enableDataIntegrityControl = 0
enableTsdixReduction = 0
homePath = $SPLUNK_DB/yourindex/db
MaxTotalDataSizeMB = 512000 #(in my case)
thawedPath = $SPLUNK_DB/yourindex/thaweddb

4) restart your splunkd service
5) now when you configure your streams in the stream app you can see your indexes in the dropdown menu

Hope it helps

[vshcherbakov_sp]

I believe it's a limitation of the current Stream UI. To work around, you can leave the index field in the newly created stream to default and specify the index on Stream TA or standalone Stream Forwarder by adding index=sandbox to the TA's inputs.conf Please note that it will affect all data collected by that instance of Stream Forwarder