Are there any recommendations for settings on the vmware indexes? Extra storage isn't a big deal but app performance is. Additionally as as our cluster changes and grows, I don't want old virtual machines and hosts information hanging around forever. The changes I made to the vmware index was an attempt to remove an old vcenter server with a different name from populating the drop-downs along with an old datastore names.
1 Cluster
5 Hosts
300 VMs
Current:
[vmware]
maxTotalDataSizeMB = 30000
coldPath = $SPLUNK_DB/vmware/colddb
homePath = $SPLUNK_DB/vmware/db
thawedPath = $SPLUNK_DB/vmware/thaweddb
frozenTimePeriodInSecs = 7776000
[summary_vmware]
homePath = $SPLUNK_DB/summary_vmware/db
coldPath = $SPLUNK_DB/summary_vmware/colddb
thawedPath = $SPLUNK_DB/summary_vmware/thaweddb
Size and retention is really up to you. However, to improve performance, what you should really do is copy the settings from the default "main" index. These are in $SPLUNK_HOME/etc/system/default/indexes.conf. Obviously settings like the path and retention should not be copied, but other settings, particularly maxDataSize and maxHotBuckets, should be copied.
Size and retention is really up to you. However, to improve performance, what you should really do is copy the settings from the default "main" index. These are in $SPLUNK_HOME/etc/system/default/indexes.conf. Obviously settings like the path and retention should not be copied, but other settings, particularly maxDataSize and maxHotBuckets, should be copied.