Splunk for Vmware App index settings

[zachvida]

Are there any recommendations for settings on the vmware indexes? Extra storage isn't a big deal but app performance is. Additionally as as our cluster changes and grows, I don't want old virtual machines and hosts information hanging around forever. The changes I made to the vmware index was an attempt to remove an old vcenter server with a different name from populating the drop-downs along with an old datastore names.

1 Cluster
5 Hosts
300 VMs

Current:
[vmware]
maxTotalDataSizeMB = 30000
coldPath = $SPLUNK_DB/vmware/colddb
homePath = $SPLUNK_DB/vmware/db
thawedPath = $SPLUNK_DB/vmware/thaweddb
frozenTimePeriodInSecs = 7776000

[summary_vmware]
homePath = $SPLUNK_DB/summary_vmware/db
coldPath = $SPLUNK_DB/summary_vmware/colddb
thawedPath = $SPLUNK_DB/summary_vmware/thaweddb

[gkanapathy · Accepted solution]

Size and retention is really up to you. However, to improve performance, what you should really do is copy the settings from the default "main" index. These are in $SPLUNK_HOME/etc/system/default/indexes.conf. Obviously settings like the path and retention should not be copied, but other settings, particularly maxDataSize and maxHotBuckets, should be copied.