Getting Data In

Is any index creation (though cli) is required to configure/onboard new API in to heavy forwarder?


Dear All,

Can you please suggest whether any index creation (though cli) is required to configure/Onboard new API in to Heavy forwarder .


APP Name :Cisco Umbrella Add-On for Splunk


Labels (1)
Tags (1)
0 Karma

Path Finder

Hey @NDabhi21,

If you're onboarding/ingesting data via any methods (REST API, scripted inputs, monitor inputs, etc), you'll need one destination where the data should get ingested in the form of index. If the question was requirement of new index for every new input, then that is not mandatory. You can group the types of inputs and have the logs ingested in one index. However for better accessibility, I would prefer having different index for different types of onboarding.

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...