Archive

define index for my app

Path Finder

i am creating a Splunk app. How do i define only a particular index to be used by the app. Only a particular index must be accessed from the app. where do i define the configurations.

Tags (4)
0 Karma

Splunk Employee
Splunk Employee

In inputs.conf you'll define the index you want for all of your inputs. In indexex.conf you will define where the index is stored.

[yourindex]
homePath = $SPLUNK_DB/yourindex/db
coldPath = $SPLUNK_DB/yourindex/colddb
thawedPath = $SPLUNK_DB/yourindex/thaweddb
maxTotalDataSizeMB = 10000

Then in all of your app searches and reports they will reference your index (start with index=yourindex). There is no way to assign an index to an app that i am aware of similar to how you can assign indexes to roles.

Splunk Employee
Splunk Employee

You can put in comments underneath the answers rather than creating a new answer. You create the app, which is only going to have views and dashboards on your index. Then you will create a user role that only has access to that index and give those users access to your app as well.

0 Karma

Path Finder

i want to configure app such that i listens to data from particular index. Objective is to provide users accessing app access data from particular index. what is the other way i can do this.

0 Karma

Path Finder

in which file do i make the changes....

0 Karma

Splunk Employee
Splunk Employee

You can set this up by creating an index.conf in $SPLUNK_HOME/etc/apps//default and adding an index configuration there.

Brian

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!