have the VNX Block data collection working (waiting for credentials for the VNX File). Have a couple of questions:
1) what is the significance of the "site = " that I put in inputs.conf? I would have expected the value to show up in the indexed events, but not seeing them. What is "site = "?
2) I have multiple arrays to collect data on. How do I separate them? coding "host = " into the inputs.conf is not setting the host field on the logged events.
1) That's an optional value: http://docs.splunk.com/Documentation/AddOns/released/EMCVNX/ConfigureModularInput
2) site is one of the ways you can do it, or you can change the names of the input stanzas and then use source=whatever.
1) site= seems to only get applied to vnx:block:agent events.
2) can you elaborate on this? This is not working for me (source is still vnx, host is still the hostname of the indexer):
[vnx_data_loader://cli_vnx_block] network_addr = cly-emcspap1.whirlpool.com network_addr2 = cly-emcspbp1.whirlpool.com username = <encrypted> password = <encrypted> platform = VNX Block site = CLY host = vnx-cly source = vnx-cly index = w_vnx disabled = 0
Enter a unique stanza name describing the input, such as sfvnx01inventory.