Splunk App and Add-on for Unix and Linux: How to change the default index name and set retention policy?

[sidekix24]

We're using the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux to capture host metrics from our forwarders. I actually have 2 questions.

How to you change the default index name to something different from "OS"? We tried changing it through the settings in the App but every time we would change it the data would stop flowing and when we changed it back to "OS" the data would start to flow again.

This one is probably more important than the first question.
Seeing though the OS index doesn't appear in the indexes.conf file, how do we control the retention policy for that index?

Thanks

[sudoiamroot]

So this is how I did it however not sure how your environment is set up. I have a distributed environment with a single site cluster with a splunk master a deployer and a search head.

First

• I deployed a new index which I named I also specified any data retention policies here. [app_name-os] repFactor = auto coldPath = $SPLUNK_DB/app_name-os/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/app_name-os/db maxTotalDataSizeMB = 2000 thawedPath = $SPLUNK_DB/app_name-os/thaweddb

Second I installed the Unix Add-on on the indexer and the search head

Then I renamed all my inputs to send to the index i created above and it worked.

[adonio]

the OS index is in indexes.conf in the app so .../etc/apps/Splunk_TA_nix/default/indexes.conf
create your own retention and configurations and create a new inputs.conf in the ..../Splunk_TA_nix/local directory.

[sidekix24]

Thanks...we'll give that try