All Apps and Add-ons

Splunk App for Unix and Linux with multiple indexes

Path Finder

With Splunk App for Unix and Linux, it's is possible to state what indexes will be used.
However is it possible to configure a splunk server that could connect to a number of environments dev,test,live each with the app on but using the splunkforwarder to send it to the central splunk but each of the environments use its own index.

0 Karma

Builder

Yes, however it might require you to edit some views.

You should take a look at macros.conf to specify your indexes.
example;

[all-indexes]
definition = index=dev OR index=test OR index=live

[dev-index]
definition = index=dev

Call the macros using all-indexes in savessearches.conf and edit the views that might contain hard-references to the "default" os index / search, grep for index=os .

0 Karma

Builder

Thats sounds like it should work 🙂

0 Karma

Path Finder

So for Splunk App for Unix and Linux
edit the macros.conf on the server
change it to the following
[os_index]
definition = index=dev OR index=test OR index=live
Create a dev,test and live index on the server

The rest of the macros.conf then uses 'os_index'

Then edit the inputs.conf on the forwarder for each environment thus Development will send it to the dev index.
Now for the icing on the cake, set a role called dev with only access to the Dev index. Lets see if this will work.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!