All Apps and Add-ons

Splunk for Vmware App index settings

zachvida
Path Finder

Are there any recommendations for settings on the vmware indexes? Extra storage isn't a big deal but app performance is. Additionally as as our cluster changes and grows, I don't want old virtual machines and hosts information hanging around forever. The changes I made to the vmware index was an attempt to remove an old vcenter server with a different name from populating the drop-downs along with an old datastore names.

1 Cluster
5 Hosts
300 VMs

Current:
[vmware]
maxTotalDataSizeMB = 30000
coldPath = $SPLUNK_DB/vmware/colddb
homePath = $SPLUNK_DB/vmware/db
thawedPath = $SPLUNK_DB/vmware/thaweddb
frozenTimePeriodInSecs = 7776000

[summary_vmware]
homePath = $SPLUNK_DB/summary_vmware/db
coldPath = $SPLUNK_DB/summary_vmware/colddb
thawedPath = $SPLUNK_DB/summary_vmware/thaweddb

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Size and retention is really up to you. However, to improve performance, what you should really do is copy the settings from the default "main" index. These are in $SPLUNK_HOME/etc/system/default/indexes.conf. Obviously settings like the path and retention should not be copied, but other settings, particularly maxDataSize and maxHotBuckets, should be copied.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Size and retention is really up to you. However, to improve performance, what you should really do is copy the settings from the default "main" index. These are in $SPLUNK_HOME/etc/system/default/indexes.conf. Obviously settings like the path and retention should not be copied, but other settings, particularly maxDataSize and maxHotBuckets, should be copied.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...