uberAgent

How to Change uberAgent’s Splunk Index Name

July 19, 2024

Contributed by:

By default, uberAgent sends the data it collects to the Splunk index uberagent.

How is the index created

The index uberagent is created in the indexer app uberAgent_indexer. The file default\indexes.conf contains the relevant definitions.

How to change the index name

If you want to change the index name, you need to do so in the following places:

indexes.conf (see above)
uberAgent configuration (see below)
macros.conf (see below)
eventtypes.conf (see below)

uberAgent configuration

The index uberAgent sends the collected data to can be configured in uberAgent’s configuration with the setting Index.

Macros.conf

The index searched in the dashboards can be configured through the uberAgent_index stanza in the file macros.conf of the dashboard (search head) app. The default is as follows:

[uberAgent_index]
definition = uberagent*
<!--NeedCopy-->

Eventtypes.conf

The index searched for the event type uberAgent_index_query can be configured through the uberAgent_index_query stanza in the file eventtypes.conf of the dashboard (search head) apps. The default is as follows:

[uberAgent_index_query]
search = index=uberagent*
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

How to Change uberAgent’s Splunk Index Name

July 19, 2024

Contributed by:

July 19, 2024

Contributed by:

How to Change uberAgent’s Splunk Index Name

How is the index created

How to change the index name

uberAgent configuration

Macros.conf

Eventtypes.conf

In this article