How to change indexes in Splunk Add-on for VMware?

[Kendo213]

This isn't an option through the UI of the application. How do you change the indexes where the data is flowing to?

[renjith_nair · Accepted solution]

Hi @Kendo213,

You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf

http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS

For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

[Kendo213]

This doesn't seem to be the case with the Splunk Add-on for Vmware.

[renjith_nair]

Would you mind providing the name of the index you want to change? It will be easy for us then to point to the app and file

[Kendo213]

The sourcetypes are coming in as vmware:perf:*

The index is vmware:perf

[renjith_nair]

Try changing the index in splunk-add-on-for-vmware_342\splunk-add-on-for-vmware_342\Splunk_TA_vmware\default\ta_vmware_collection.conf

Reference : https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference