All Apps and Add-ons
Highlighted

Splunk Add-on for EMC VNX: How to set host fields and what is the significance of site= in inputs.conf?

Contributor

have the VNX Block data collection working (waiting for credentials for the VNX File). Have a couple of questions:

1) what is the significance of the "site = " that I put in inputs.conf? I would have expected the value to show up in the indexed events, but not seeing them. What is "site = "?

2) I have multiple arrays to collect data on. How do I separate them? coding "host = " into the inputs.conf is not setting the host field on the logged events.

0 Karma
Highlighted

Re: Splunk Add-on for EMC VNX: How to set host fields and what is the significance of site= in inputs.conf?

Splunk Employee
Splunk Employee

Hi,

1) That's an optional value: http://docs.splunk.com/Documentation/AddOns/released/EMCVNX/ConfigureModularInput

2) site is one of the ways you can do it, or you can change the names of the input stanzas and then use source=whatever.

0 Karma
Highlighted

Re: Splunk Add-on for EMC VNX: How to set host fields and what is the significance of site= in inputs.conf?

Contributor

1) site= seems to only get applied to vnx:block:agent events.

2) can you elaborate on this? This is not working for me (source is still vnx, host is still the hostname of the indexer):

[vnx_data_loader://cli_vnx_block]
network_addr = cly-emcspap1.whirlpool.com
network_addr2 = cly-emcspbp1.whirlpool.com
username = <encrypted>
password = <encrypted>
platform = VNX Block
site = CLY
host = vnx-cly
source = vnx-cly
index = w_vnx
disabled = 0
0 Karma
Highlighted

Re: Splunk Add-on for EMC VNX: How to set host fields and what is the significance of site= in inputs.conf?

Splunk Employee
Splunk Employee

Enter a unique stanza name describing the input, such as sfvnx01inventory.

[vnxdataloader://]

0 Karma