We're using the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux to capture host metrics from our forwarders. I actually have 2 questions.
How to you change the default index name to something different from "OS"? We tried changing it through the settings in the App but every time we would change it the data would stop flowing and when we changed it back to "OS" the data would start to flow again.
This one is probably more important than the first question.
Seeing though the OS index doesn't appear in the indexes.conf file, how do we control the retention policy for that index?
So this is how I did it however not sure how your environment is set up. I have a distributed environment with a single site cluster with a splunk master a deployer and a search head.
I deployed a new index which I named I also specified any data retention policies here.
repFactor = auto
coldPath = $SPLUNK_DB/app_name-os/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/app_name-os/db
maxTotalDataSizeMB = 2000
thawedPath = $SPLUNK_DB/app_name-os/thaweddb
Second I installed the Unix Add-on on the indexer and the search head
Then I renamed all my inputs to send to the index i created above and it worked.
the OS index is in indexes.conf in the app so .../etc/apps/Splunk_TA_nix/default/indexes.conf
create your own retention and configurations and create a new inputs.conf in the ..../Splunk_TA_nix/local directory.