tracetore.blogg.se

1. #SPLUNK ADD A FILE MONITOR INPUT TO SEND EVENTS TO THE INDEX HOW TO#
2. #SPLUNK ADD A FILE MONITOR INPUT TO SEND EVENTS TO THE INDEX ARCHIVE#

Important: To send events to a specific index, the index must already exist on the indexer. Or you might want to segment data or send event data from a noisy source to an index that is dedicated to receiving it. For example, you might want to route all data from a particular input to its own index. However, you might want to send some events to other indexes. You must restart the indexer after editing nf.įor information on adding or editing index configurations on cluster nodes, see Configure the peer indexes in an indexer cluster.īy default, all external events go to the index called main. They cannot begin with an underscore or hyphen, or contain the word "kvstore". Note: User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens. To add a new index called "fflanda", enter the following command:įor information on index settings, see Configure index storage and the nf spec file. You do not need to stop the indexer first. Navigate to the $SPLUNK_HOME/bin/ directory and use the add index command. Check the nf topic for a complete list of properties. Note: Some index properties are configurable only by editing the nf file. To change those properties, edit nf, then restart the indexer. Properties that you cannot change in Splunk Web are grayed out. You can edit an index by clicking on the index name in the Indexes section of the Settings menu in Splunk Web. See Reduce tsidx usage.įor more information on index settings, see Configure index storage.

#SPLUNK ADD A FILE MONITOR INPUT TO SEND EVENTS TO THE INDEX ARCHIVE#

For information on bucket archiving, see Archive indexed data. Set this field if you want to archive frozen buckets. When setting the maximum size, use auto_high_volume for high volume indexes (such as the main index) otherwise, use auto.

In Splunk Web, navigate to Settings > Indexes and click New. You also cannot use Splunk Web to add a non-SmartStore index, if the indexer has any SmartStore indexes. You cannot use Splunk Web to add a SmartStore index. That topic includes an example of creating a new cluster index.

#SPLUNK ADD A FILE MONITOR INPUT TO SEND EVENTS TO THE INDEX HOW TO#

For information on how to configure nf for clusters, see Configure the peer indexes in an indexer cluster. You cannot add an index via Splunk Web or the CLI. Note: To add a new index to an indexer cluster, you must directly edit nf. You can create events indexes with Splunk Web, the CLI, or by editing nf directly. You'll probably notice an increase in search speed. Then, you can specify which index to search on. To mitigate this, you can create dedicated indexes for each data source and send data from each source to its dedicated index. If you have both a high-volume/high-noise data source and a low-volume data source feeding into the same index, and you search mostly for events from the low-volume data source, the search speed will be slower than necessary, because the indexer also has to search through all the data from the high-volume source. In addition, if you have different policies for retention for different sets of data, you might want to send the data to different indexes and then set a different archive or retention policy for each index.Īnother reason to set up multiple indexes has to do with the way search works. When you assign users to roles, you can limit user searches to specific indexes based on the role they're in. The main reason you'd set up multiple indexes is to control user access to the data that's in them.

Events indexes are the default index type.