Splunk Add-on for EMC VNX: How to set host fields and what is the significance of site= in inputs.conf?

[wegscd]

have the VNX Block data collection working (waiting for credentials for the VNX File). Have a couple of questions:

1) what is the significance of the "site = " that I put in inputs.conf? I would have expected the value to show up in the indexed events, but not seeing them. What is "site = "?

2) I have multiple arrays to collect data on. How do I separate them? coding "host = " into the inputs.conf is not setting the host field on the logged events.

[jcoates_splunk]

Hi,

1) That's an optional value: http://docs.splunk.com/Documentation/AddOns/released/EMCVNX/ConfigureModularInput

2) site is one of the ways you can do it, or you can change the names of the input stanzas and then use source=whatever.

[wegscd]

1) site= seems to only get applied to vnx:block:agent events.

2) can you elaborate on this? This is not working for me (source is still vnx, host is still the hostname of the indexer):

[vnx_data_loader://cli_vnx_block]
network_addr = cly-emcspap1.whirlpool.com
network_addr2 = cly-emcspbp1.whirlpool.com
username = <encrypted>
password = <encrypted>
platform = VNX Block
site = CLY
host = vnx-cly
source = vnx-cly
index = w_vnx
disabled = 0

[jcoates_splunk]

Enter a unique stanza name describing the input, such as sf_vnx01_inventory.

[vnx_data_loader://]