I have just installed a Splunk App where the logs are from some appliances, so obviously they are sending syslog to our Splunk Indexer. However, this Splunk App is only suitable for analyzing specific logs of one of the vendor appliances (vendor specific Splunk App). So, the problem is that I configured all my network devices (i.e. switch, router, firewall, etc) to send syslog to our Splunk Indexer where the Splunk Indexer stores these logs in the "main" Index. So, how do I tell the newly installed Splunk App to only capture the "needed" logs to perform analysis from the pool of logs in the "Main" index? (The "need to analyze" logs are in the pool of logs stored in "Main" Index) ... View more

Hi all! I checked in the forum that someone has already asked similar question. ++++++Copy from another question and answer+++++ For example, if you are trying to move the sourcetype WinEventLog:Application from the main (default) index to the os index, something like this could get you started: splunk cmd exporttool defaultdb/db_1262807912_1262278800_6 /dev/stdout -csv sourcetype::WinEventLog:Application | splunk cmd importtool os/db_temp /dev/stdin ++++++++++++++++++++++++++++++++++++++++++++ However, this can only copy the data from one index to another index. If new data keeps coming in, the data still be indexed in the old index. Basically, my situation is as follows: I installed a Splunk App that allows Splunk users to investigate Apache web traffic. However, the Splunk App has set, by default, to process and search data in apache_^ index. Unfortunately, my Apache web traffic data is in "apache" index. So how can I configure the Splunk to permanently index Apache web traffic data to "apache_^" index instead of "apache" index? ... View more

Hi all! I am Charles from Hong Kong and new to Splunk. Hello everyone! My boss asked me to fully utilize our newly installed Splunk Indexer and Heavy Forwarder by installing as much Splunk Apps as it can. However, the indexer has only been assigned 8 core CPU and 500GB of storage, where my Splunk vendor suggested me to assign 24 core CPU to it (impossible!!) I am worrying that if I installed too much apps on the indexer will result in degrading the performance of Splunk, or even crash the system. Any of you have such experiences on how to estimate the largest possible numbers of Splunk apps that can be installed and can share with me please? Thanks! P.S. Our indexer currently receiving around 10 GB of data per day. ... View more