All Apps and Add-ons

How to change indexes in Splunk Add-on for VMware?

Kendo213
Communicator

This isn't an option through the UI of the application. How do you change the indexes where the data is flowing to?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @Kendo213,

You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf

http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS

For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @Kendo213,

You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf

http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS

For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

Happy Splunking!
0 Karma

Kendo213
Communicator

This doesn't seem to be the case with the Splunk Add-on for Vmware.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Would you mind providing the name of the index you want to change? It will be easy for us then to point to the app and file

Happy Splunking!
0 Karma

Kendo213
Communicator

The sourcetypes are coming in as vmware:perf:*

The index is vmware:perf

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try changing the index in splunk-add-on-for-vmware_342\splunk-add-on-for-vmware_342\Splunk_TA_vmware\default\ta_vmware_collection.conf

Reference : https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...