Reader small image

You're reading from  Splunk Developer's Guide - Second Edition

Product typeBook
Published inJan 2016
Publisher
ISBN-139781785882371
Edition2nd Edition
Tools
Right arrow
Authors (2):
Marco Scala
Marco Scala
author image
Marco Scala

Marco Scala has been working for more than 15 years in delivering solutions to Large Enterprise Customers, first in the APM and J2EE field, and since 2009 in the field of Operational Intelligence and Splunk. He has provided consultancy for big Splunk installations on major Customers, focusing on the best and more effective solution for each different Customer's need. Since 2012 he's also a Certified Splunk Trainer. In the last years his major focus is to get Splunk Customer to gain the maximum value from their IT data, and provide the Business a better view and insight. BigData is another major field of interest, and his next challenge is using Splunk to give Customers useful insights and a practical implementation and exploitation of BigData.
Read more about Marco Scala

Kyle Smith
Kyle Smith
author image
Kyle Smith

Kyle Smith is a self-proclaimed geek and has been working with Splunk extensively since 2010. He enjoys integrating Splunk with new sources of data and types of visualization. He has spoken numerous times at the Splunk User Conference (most recently in 2014 on Lesser Known Search Commands) and is an active contributor to the Splunk Answers community and also to the #splunk IRC channel. He was awarded membership into the SplunkTrust as a founding member. He has published several Splunk Apps and add-ons to Splunkbase, the Splunk community's premier Apps and add-ons platform. He has worked in both higher education and private industry; he is currently working as an integration developer for Splunk's longest running professional services partner. He lives in central Pennsylvania with his family.
Read more about Kyle Smith

View More author details
Right arrow

Application data


Now that we have created a new App, we can start working on how we need our data indexed. Typical Apps may contain configurations for their own indexes, source types, and other input methods.

Indexes

Indexes are very useful in a new App as they allow you to physically separate the data on the disk on the indexers. This helps speed up searches and optimizes macros and event types, since only a smaller subset of data will be searched within the App. The configurations of the indexes are in the indexes.conf file, in the default folder. For our App, let's add an index. The configuration looks like this in the indexes.conf file, located at $APP_HOME/default/indexes.conf:

[splunk_developers_guide]
coldPath = $SPLUNK_DB\splunk_developers_guide\colddb
homePath = $SPLUNK_DB\splunk_developers_guide\db
thawedPath = $SPLUNK_DB\splunk_developers_guide\thaweddb

That's it! Defining indexes is a quick way of optimizing your App's data. You can also create indexes using the GUI. To make sure...

lock icon
The rest of the page is locked
Previous PageNext Page
You have been reading a chapter from
Splunk Developer's Guide - Second Edition
Published in: Jan 2016Publisher: ISBN-13: 9781785882371

Authors (2)

author image
Marco Scala

Marco Scala has been working for more than 15 years in delivering solutions to Large Enterprise Customers, first in the APM and J2EE field, and since 2009 in the field of Operational Intelligence and Splunk. He has provided consultancy for big Splunk installations on major Customers, focusing on the best and more effective solution for each different Customer's need. Since 2012 he's also a Certified Splunk Trainer. In the last years his major focus is to get Splunk Customer to gain the maximum value from their IT data, and provide the Business a better view and insight. BigData is another major field of interest, and his next challenge is using Splunk to give Customers useful insights and a practical implementation and exploitation of BigData.
Read more about Marco Scala

author image
Kyle Smith

Kyle Smith is a self-proclaimed geek and has been working with Splunk extensively since 2010. He enjoys integrating Splunk with new sources of data and types of visualization. He has spoken numerous times at the Splunk User Conference (most recently in 2014 on Lesser Known Search Commands) and is an active contributor to the Splunk Answers community and also to the #splunk IRC channel. He was awarded membership into the SplunkTrust as a founding member. He has published several Splunk Apps and add-ons to Splunkbase, the Splunk community's premier Apps and add-ons platform. He has worked in both higher education and private industry; he is currently working as an integration developer for Splunk's longest running professional services partner. He lives in central Pennsylvania with his family.
Read more about Kyle Smith