All Apps and Add-ons

Splunk Add-on for Amazon Web Services: Why are VPC Flow logs writing to local index and not our storage based index?

cwyse
Explorer

We started collecting VPC flow logs at some point. But it started writing them to /opt/splunk/var/lib/splunk/$INDEXNAME instead of the /EBS/$INDEXNAME which is where the actual index I wanted to write was. This is only datamodel_summary info. When switched to default or main we see the same thing. It writes to the local / directory instead of EBS. Anyone know how to change this? So we decided to remove the vpc_flow information all together, but somehow it keeps coming in. I'm not sure how it's getting the info, how to make it stop, or how to make it at least go to the right place. Any ideas?

0 Karma

jeffland
SplunkTrust
SplunkTrust

It should work like this: in your inputs.conf, you define which index the data is sent to. In indexes.conf, you define where an input is located on disk.

Did you set up any of these .conf files by hand, or are you using them as they came with the app? I must admit I don't know what the standard settings are, but you should probably check the app and see a) which index your data is routed to and b) where that index is located, and change those settings accordingly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...