All Apps and Add-ons

Splunk App and Add-on for Unix and Linux: How to change the default index name and set retention policy?

sidekix24
Path Finder

We're using the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux to capture host metrics from our forwarders. I actually have 2 questions.

How to you change the default index name to something different from "OS"? We tried changing it through the settings in the App but every time we would change it the data would stop flowing and when we changed it back to "OS" the data would start to flow again.

This one is probably more important than the first question.
Seeing though the OS index doesn't appear in the indexes.conf file, how do we control the retention policy for that index?

Thanks

sudoiamroot
Explorer

So this is how I did it however not sure how your environment is set up. I have a distributed environment with a single site cluster with a splunk master a deployer and a search head.

First

  • I deployed a new index which I named I also specified any data retention policies here. [app_name-os] repFactor = auto coldPath = $SPLUNK_DB/app_name-os/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/app_name-os/db maxTotalDataSizeMB = 2000 thawedPath = $SPLUNK_DB/app_name-os/thaweddb

Second I installed the Unix Add-on on the indexer and the search head

Then I renamed all my inputs to send to the index i created above and it worked.

adonio
Ultra Champion

the OS index is in indexes.conf in the app so .../etc/apps/Splunk_TA_nix/default/indexes.conf
create your own retention and configurations and create a new inputs.conf in the ..../Splunk_TA_nix/local directory.

0 Karma

sidekix24
Path Finder

Thanks...we'll give that try

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...