Configure Inputs for the Splunk Add-on for BMC Remedy

After you have Set up the add-on, configure your inputs to collect data. Configure inputs on your data collection node, usually a heavy forwarder.

1. In the Splunk Add-on for BMC Remedy, click the Inputs tab.
2. Click Create New Input.
3. In the Add Remedy Input box, complete the following fields:




Field	Description
Name	Enter a unique name for the input.
Account	Enter your BMC Remedy Rest Account Name.
Interval	The data collection interval, in seconds.
Form type	Select a BMC Remedy form name from the list. (Splunk currently supports incident, audit, and incident work log forms.)
Form name	Name of the form that will be used to collect the data. (Form name for Incident and Incident WorkLog is fixed, where user will be able to modify the form name to custom form in case of Audit Form type.)
Included Properties	Enter field names separated by commas from the form that you want to include. You can either include or exclude properties for an input, but not both.
Excluded Properties	Enter field names separated by commas from the form that you want to exclude.
Time field of the form	The time field to use for checkpoint creation and _time field. The default is Last Modified Date.
Use existing data input?	This field only displays if the add-on finds an existing checkpoint for hte given input name. If you select "Yes", the add-on collects from that checkpoint. If "No" is selected, the add-on resets data collection and starts from either the provided query start date or the default query start date.
Query Start Date	The date that Splunk started collecting data from the remedy form, in UTC "MM/DD/YYYY HH:MM:SS" format. Default is one week ago.
Qualification parameters	Provide qualification in key-value pairs as shown in example to fetch only selected data from the form eg. 'key1'="value1" AND 'key2'="value2" (By default no qualification will be applied). Eg: 'Assignee'="Mary Mann" AND 'Priority'="Critical".
Index	The index that stores the events collected from this input. The default index is main.

4. Click Save
5. After you save, Splunk displays the input in the table and you can toggle the status button to enable it to start collecting data.