All Apps and Add-ons

Should a custom Splunk app use a separate index by default?

Justin_Grant
Contributor

We're building a Splunk app and need to decide which index to use to store the events captured by our app's inputs. We'll let the use choose the index in our app's Setup configuration page (aka setup.xml), but we need to decide on a default.

Got a suggestion for whether our default should be "main" or should be a custom index for the app? If "it depends" then when would we want to choose one option over the other?

Tags (3)

gkanapathy
Splunk Employee
Splunk Employee

I would generally recommend that data go to the system default (i.e., main) index by default. There is a significant environment-specific and system-level configuration for defining an index (disk space, volumes, retention policy, etc), and by specifying a new one, you would be significantly complicating the (correct) installation of your application. Separate identification of your data can be accomplished with distinct sourcetypes.

A separate index is important if you need to be able to move, delete, age, archive (etc) this data differently from the rest of the data in Splunk. You can and should think about doing this, but I would say that you should think about it separately from installation and configuration of the app. If necessary, it should be done before app installation. You can define these parameters for the index, and then tell your app inputs to use that index. But you should not force this by default.

gkanapathy
Splunk Employee
Splunk Employee

you can use default

0 Karma

Justin_Grant
Contributor

OK, thanks! Inside the app config, can we use the word "default" or should we use "main" as index name?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...