capabilities.work

Provision an Index and Attach a Monitor Input

A 4-step recipe with Splunk. We can help you get access.

Recipe · 4 steps

Provision an Index and Attach a Monitor Input

with Splunk

Create an index, confirm it, attach a monitor input, and confirm the input.

  1. Create a new event index with the supplied retention and size settings.
  2. Fetch the newly created index to confirm it exists and read back its configuration.
  3. Create a file or directory monitor input that ingests new data into the index just provisioned.
  4. Fetch the monitor input to confirm it is configured against the new index.
What you'll need to have ready
  • indexName: Name for the new index (e.g. "my_new_index").
  • maxTotalDataSizeMB: Maximum total size of the index in MB.
  • frozenTimePeriodInSecs: Seconds until data is frozen out of the index.
  • monitorPath: The file or directory path to monitor (e.g. "/var/log/syslog").
  • sourcetype: Source type to assign to data from the monitor input.
For your developer

Arazzo workflow splunk:provision-index-and-monitor, 4 operations: createIndex → getIndex → createMonitorInput → getMonitorInput. Specs on APIs.io.

More recipes with Splunk

Finalize, Read, and Clean Up a Search JobHEC Ingest an Event and Confirm IndexingIngest Raw Data then Search for ItRun a Search Job and Retrieve ResultsSearch and Retrieve Raw Events