All Apps and Add-ons

How to get data in custom index on Windows App

dishasaxena
Path Finder

We are trying to get data in custom index from Windows addOn installed on windows forwarder by changing index name in its inputs.conf. It is making us to get this data in our custom index on receiving Indexer but we also want to get this data to reflect in Windows App. We have installed Windows App on this indexer and have done same changes in inputs.conf file on Indexer's Windows App folder as well before configuring it but still are not able to get data from forwarder in Windows App.
Could anyone please help us here.

0 Karma

rmsit
Communicator

Think this is the answer. After modifying the roles to include the new index for search, the dashboard overviews work.

http://answers.splunk.com/answers/117431/modifying-the-all-indexed-data-dashboard-for-custom-indices...

martin_mueller
SplunkTrust
SplunkTrust

You need to change the queries in the app to look into your custom index. I think all you need to do is adjust the eventtypes, but it's been a while since I used that app...

0 Karma

rmsit
Communicator

Having the same issue. I created a new "perfmon" index for Windows performance data. I changed the "Windows_Performance" Event Types in the Windows App on search head, ran an update on lookups with desired results - Windows Performance dashboard show data from new index. However, the Windows Overview page does not show data from "perfmon" index. I have also changed the "perfmon_windows" event type on the indexer to include the new index which does not seem to work.

0 Karma

dishasaxena
Path Finder

Hi Martin,

Thanks for the idea, I will try it and then will revert with the findings.

Regards,
Disha

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...