Application data
Now that we have created a new App, we can start working on how we need our data indexed. Typical Apps may contain configurations for their own indexes, source types, and other input methods.
Indexes
Indexes are very useful in a new App as they allow you to physically separate the data on the disk on the indexers. This helps speed up searches and optimizes macros and event types, since only a smaller subset of data will be searched within the App. The configurations of the indexes are in the indexes.conf file, in the default folder. For our App, let's add an index. The configuration looks like this in the indexes.conf file, located at $APP_HOME/default/indexes.conf:
[splunk_developers_guide] coldPath = $SPLUNK_DB\splunk_developers_guide\colddb ...
Get Splunk Developer's Guide - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
