All Apps and Add-ons

How to change indexes in Splunk Add-on for VMware?

Kendo213
Communicator

This isn't an option through the UI of the application. How do you change the indexes where the data is flowing to?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @Kendo213,

You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf

http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS

For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @Kendo213,

You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf

http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS

For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

View solution in original post

0 Karma

Kendo213
Communicator

This doesn't seem to be the case with the Splunk Add-on for Vmware.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Would you mind providing the name of the index you want to change? It will be easy for us then to point to the app and file

0 Karma

Kendo213
Communicator

The sourcetypes are coming in as vmware:perf:*

The index is vmware:perf

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try changing the index in splunk-add-on-for-vmware_342\splunk-add-on-for-vmware_342\Splunk_TA_vmware\default\ta_vmware_collection.conf

Reference : https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!