have the VNX Block data collection working (waiting for credentials for the VNX File). Have a couple of questions:
1) what is the significance of the "site = " that I put in inputs.conf? I would have expected the value to show up in the indexed events, but not seeing them. What is "site = "?
2) I have multiple arrays to collect data on. How do I separate them? coding "host = " into the inputs.conf is not setting the host field on the logged events.
Hi,
1) That's an optional value: http://docs.splunk.com/Documentation/AddOns/released/EMCVNX/ConfigureModularInput
2) site is one of the ways you can do it, or you can change the names of the input stanzas and then use source=whatever.
1) site= seems to only get applied to vnx:block:agent events.
2) can you elaborate on this? This is not working for me (source is still vnx, host is still the hostname of the indexer):
[vnx_data_loader://cli_vnx_block]
network_addr = cly-emcspap1.whirlpool.com
network_addr2 = cly-emcspbp1.whirlpool.com
username = <encrypted>
password = <encrypted>
platform = VNX Block
site = CLY
host = vnx-cly
source = vnx-cly
index = w_vnx
disabled = 0
Enter a unique stanza name describing the input, such as sf_vnx01_inventory.
[vnx_data_loader://]