Create new index

Splunk ships with an index called main that, by default, holds all your events. Splunk with an Enterprise license lets you add an unlimited number of additional indexes. One of them serves as the default index for any input and search command that don't specify any index. You can add indexes via Splunk Web, Splunk's CLI, or indexes.conf.

via Splunk Web

1. The Admin > Indexes: Create Index page lets you define the properties for a new index. To create a new index, enter:

A name for the index.
The maximum size (in MB) of the hot database.
The maximum size (in MB) of the index.

2. If you check Advanced settings, the list of properties expands. Advanced properties include:

The maximum number of search results.
The maximum number of warm database directories.
The maximum number of cold databases open at any given time.
The frequency that new hot database are to be created.
The frequency that cold databases are to be frozen.
The script and directory to archive the index's data.
The number of concurrently running optimize processes.
Whether to wait for optimize processes to finish or just kill them.
The number of extra threads to use during indexing.
The amount of memory (in MB) to allocate for indexing.
The number of events to make up a block for block signatures.

3. After setting the index's properties, click Add.

4. Restart Splunk to save and apply your changes.

Important: To apply any changes that you make to the indexes, such as editing properties or adding a new index, you must restart Splunk. In Splunk Web, you can restart the Splunk server from Admin > Server: Control Server. Just click Restart Now.

Note: You can also use Splunk Web's Admin > Indexes page to edit an index at any time; just click on the index name to access the index's properties. Properties that you cannot change in Splunk Web are grayed out. For more information about configuring index properties, read indexes.conf.

via the CLI

To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

To add an index, first shutdown Splunk with splunk stop. Then navigate to Splunk's CLI. Then type:

# ./splunk add index [name] [directory (optional)]

Note: Do not use capital letters in your index name; this is a known problem that will be fixed.

The optional directory argument lets you set up an index outside of the default $SPLUNK_DB location.

The add index command brings you to a dialog session. Specify the configurations of your new index:

./splunk add index hatch

Hit enter to accept the default values in parenthesis, or enter your own values.

Previous: Manage your indexes | Next: Delete an index

Comments

No comments have been submitted.