Use An Alternative Index¶

Website Monitoring can be setup to use an alternative index such that the data isn't stored in the "main" index.

Here is how you set that up.

Step 1: Create Your Index¶

Create your index within Splunk. See http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes.

Then, click the checkbox next to "More settings" on the modular input configuration page for the input you want to go to that index. You should see a dropdown under the "Index" area that will allow you to select the index.

Save the input. The data will now go to that index.

Step 2: Send the Data to Your Custom Index¶

Modify your Website Monitoring inputs such that they send the data to the index you just created. You can do this by clicking the checkbox next to "More settings" on the modular input configuration page for the input you want to go to that index. You should see a dropdown under the "Index" area that will allow you to select the index.

Save the input. The data will now go to that index.

Step 3: Tell the Website Monitoring to Load the Data from Your Custom Index¶

Finally, modify the macro named "website_monitoring_search_index" within the Website Monitoring app to define the index (or indexes) where the data will reside. For example, if your index was named "web_data", then the macro value would be "(index=web_data)". The resulting macro should look like this in the macros.conf (etc/apps/website_montoring/local/macros.conf):

[website_monitoring_search_index]
definition = (index=web_data)

Note that you will need Website Monitoring 2.6 or greater to use this macro.

Alternatively, you can also just set the index to be in the list of default search indexes. If you do that, you don't have to modify the macro at all.