pwnlandia / mhn-splunk Goto Github PK

I would like to request a modification to use an index macro

Using an index macro is a standard, best practice for Splunk applications. Currently, when a dashboards loads you are searching every index that is searched by default.

That can have two issues:

1. It searches entirely too much data in large deployments -- we bring in over 2TB/day of data besides mhn and your searches are searching all of it even though mhn data will be limited to one index
2. It can miss the data. If the data the mhn data is coming into is not listed in the users indexes to search by default, the dashboards will not populate even if the user has access to the data

While you can't make everything automagically work out of the box for all deployments, by using an index macro, a Splunk administrator has one thing he/she needs to edit in order to make the dashboards work / apply a potentially large optimization

I have installed splunk and on the same server as MHN. It starts up but I cant login to the webpage. What port does it run on? I have tried 8000 and 8001.

SKP

Hello masters,
where I should setup my remote MHN IP and port to be read by this app. Or I need configure it in the own MHN directory /opt/hpfeeds-logger/splunk.json?

Thanks!

All of the dashboards use a common base search: source="mhn-splunk.log"

I would like to request a macro be used instead.

You could default the macro to the same value (although I have a different suggestion).

By leveraging a macro, you are inserting a seem (thinks seems from software engineering) that allows an administrator to modify what data is searched. This is particularly helpful in large deployments when search optimizations can make a big difference.

My personal suggestion would be to:

1. Switch from source to sourcetype; this is more standard Splunk behavior. Since the current instructions do not suggest settings a sourcetype, the sourcetype is likely mhn-splunk OR mhn-splunk-i where i is an integer (from sourcetype learning) or mhn-splunk-toosmall (if not enough data had been seen for learned sourcetyping). By using sourcetype=splunk-mhn* you will match all of those sourcetypes
2. Add the index macro requested in #5
3. For our deployment, I am setting a sourcetype on the input and I'm using mhn, so I think the best combination given the current situation (historical non-sourcetyped) and the suggested best practice of setting a sourcetype on the inputs.

https://splunkbase.splunk.com/app/2707/
is there any solution for this one?