Dear All,
Can you please suggest whether any index creation (though cli) is required to configure/Onboard new API in to Heavy forwarder .
APP Name :Cisco Umbrella Add-On for Splunk
Hey @NDabhi21,
If you're onboarding/ingesting data via any methods (REST API, scripted inputs, monitor inputs, etc), you'll need one destination where the data should get ingested in the form of index. If the question was requirement of new index for every new input, then that is not mandatory. You can group the types of inputs and have the logs ingested in one index. However for better accessibility, I would prefer having different index for different types of onboarding.