All Apps and Add-ons

Splunk for Vmware App index settings

zachvida
Path Finder

Are there any recommendations for settings on the vmware indexes? Extra storage isn't a big deal but app performance is. Additionally as as our cluster changes and grows, I don't want old virtual machines and hosts information hanging around forever. The changes I made to the vmware index was an attempt to remove an old vcenter server with a different name from populating the drop-downs along with an old datastore names.

1 Cluster
5 Hosts
300 VMs

Current:
[vmware]
maxTotalDataSizeMB = 30000
coldPath = $SPLUNK_DB/vmware/colddb
homePath = $SPLUNK_DB/vmware/db
thawedPath = $SPLUNK_DB/vmware/thaweddb
frozenTimePeriodInSecs = 7776000

[summary_vmware]
homePath = $SPLUNK_DB/summary_vmware/db
coldPath = $SPLUNK_DB/summary_vmware/colddb
thawedPath = $SPLUNK_DB/summary_vmware/thaweddb

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Size and retention is really up to you. However, to improve performance, what you should really do is copy the settings from the default "main" index. These are in $SPLUNK_HOME/etc/system/default/indexes.conf. Obviously settings like the path and retention should not be copied, but other settings, particularly maxDataSize and maxHotBuckets, should be copied.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Size and retention is really up to you. However, to improve performance, what you should really do is copy the settings from the default "main" index. These are in $SPLUNK_HOME/etc/system/default/indexes.conf. Obviously settings like the path and retention should not be copied, but other settings, particularly maxDataSize and maxHotBuckets, should be copied.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...