Splunk Tutorial
Selected Reading
- Splunk - Discussion
- Splunk - Useful Resources
- Splunk - Quick Guide
- Splunk - Stats Command
- Splunk - Top Command
- Splunk - Sort Command
- Splunk - Monitoring Files
- Splunk - Custom Chart
- Splunk - Removing Data
- Splunk - Apps
- Splunk - Tags
- Splunk - Calculated Fields
- Splunk - Managing Indexes
- Splunk - Sparklines
- Splunk - Overlay chart
- Splunk - Basic Chart
- Splunk - Event Types
- Splunk - Search Macros
- Splunk - Subseraching
- Splunk - Knowledge Management
- Splunk - Schedules and Alerts
- Splunk - Lookups
- Splunk - Pivot & Datasets
- Splunk - Dashboards
- Splunk - Reports
- Splunk - Transforming commands
- Splunk - Search Optimization
- Splunk - Search Language
- Splunk - Sharing and Exporting
- Splunk - Time Range Search
- Splunk - Field Searching
- Splunk - Basic Searching
- Splunk - Source Types
- Splunk - Data Ingestion
- Splunk - Interfaces
- Splunk - Environment
- Splunk - Overview
- Splunk - Home
Selected Reading
- Who is Who
- Computer Glossary
- HR Interview Questions
- Effective Resume Writing
- Questions and Answers
- UPSC IAS Exams Notes
Splunk - Managing Indexes
Splunk - Managing Indexes
Indexing is a mechanism to speed up the search process by giving numeric addresses to the piece of data being searched. Splunk indexing is similar to the concept of indexing in databases. The installation of Splunk creates three default indexes as follows.
main − This is Splunk s default index where all the processed data is stored.
Internal − This index is where Splunk s internal logs and processing metrics are stored.
audit − This index contains events related to the file system change monitor, auditing, and all user history.
The Splunk Indexers create and maintain the indexes. When you add data to Splunk, the indexer processes it and stores it in a designated index (either, by default, in the main index or in the one that you identify).
Checking Indexes
We can have a look at the existing indexes by going to Settings → Indexes after logging in to Splunk. The below image shows the option.
On further cpcking on the indexes, we can see the pst of indexes Splunk maintains for the data that is already captured in Splunk. The below image shows such a pst.
Creating a New Index
We can create a new index with desired size by the data that is stored in Splunk. The additional data that comes in can use this newly created index but better search functionapty. The steps to create an index is Settings → Indexes → New Index. The below screen appears where we mention the name of the index and memory allocation etc.
Indexing the Events
After creating the index above we can configure the events to be indexed by this specific index. We choose the event type. Use the path Settings → Data Inputs → Files & Directories. Then we choose the specific file of the events which we want to attach to the newly created event. As you can see in the below image, we have assigned the index named index_web_app to this specific file.
Advertisements