-
Book Overview & Buying
-
Table Of Contents
Splunk Developer's Guide, Second Edition - Second Edition
By :
Now that we have created a new App, we can start working on how we need our data indexed. Typical Apps may contain configurations for their own indexes, source types, and other input methods.
Indexes are very useful in a new App as they allow you to physically separate the data on the disk on the indexers. This helps speed up searches and optimizes macros and event types, since only a smaller subset of data will be searched within the App. The configurations of the indexes are in the indexes.conf file, in the default folder. For our App, let's add an index. The configuration looks like this in the indexes.conf file, located at $APP_HOME/default/indexes.conf:
[splunk_developers_guide] coldPath = $SPLUNK_DB\splunk_developers_guide\colddb homePath = $SPLUNK_DB\splunk_developers_guide\db thawedPath = $SPLUNK_DB\splunk_developers_guide\thaweddb
That's it! Defining indexes is a quick way of optimizing your App's data. You can also create indexes using the GUI...
Change the font size
Change margin width
Change background colour