Splunk Cloud - what's the best practice to send logs via unix app to cloud from test and prod servers?

[lakshman239]

We have a splunk cloud that acts as both test and prod env. I can load the splunk unix and windows add-on to the cloud with splunk support/managed service.
For test env, on the data sources, I can create local/inputs.conf to have index "os_test" and for prod "os_prod". This way the data should be landing in diff indexes in the splunk cloud.

My question is if we deploy the standard unix and windows add-on to the cloud, how do we add the additional os_test and os_prod indexes? will adding indexes via the GUI be sufficient or is there a better practice to manage them in such situations? we would want to add multiple copies of the same app with different indexes, if possible.

Thanks in advance.

[khourihan_splun]

If you are asking will the app work if you use different index names? in the Unix app, in particular, it uses a macro os_index see below:

You'd need to add the additional index names into that Macro.

I've not used the *nix app in a while, but looks like you can do some setup using the app's GUI:

So hopefully you will be able to effect the change that way, but editing the macro is a sure fire way.

[khourihan_splun]

If the app doesn't have the indexes declared in it (an indexes.conf bundled with it), you will have to create the indexes manually via GUI. You will get an error saying something about an unknown / unconfigured index if you are forwarding to an index that doesn't exist.

[lakshman239]

Thanks Khourihan. The default *nix app comes with 'indexes.conf' (e.g. os). Yes, I can add an index via cloud GUI and that should be setup/copied on to indexers.

The question is can I have os_test and os_prod created from GUI, with just one add-on (i.e. Splunk_TA_nix) loaded on to cloud, as opposed to creating multiple copies. Pls let me know, if I am not clear.

[jkat54]

You would need splunk support to create two of the same app but that should be doable too.

I dont believe there is a "best practice" other than what you already have in mind. Two apps, each with it's own 'os_index' macro.

[lakshman239]

Thanks Jkat. Let me chk and get back.