Use a test index to test your inputs

Before you add new inputs to a production index on your instance, it's a good idea to test the inputs first by adding them to a test index. After you verify that you're receiving the right data and that the resulting events are in a usable form, you can reconfigure the inputs to a production index. You can continue to test new inputs this way over time. If you find that the inputs you started with aren't the ones you want, you can keep working with the test index until you get results you like.

You can also preview how indexes your data into a test index. During preview, adjust the event processing settings interactively. See Assign the correct source type to your data for details.

Use a test index

1. Create the test index using Splunk Web or, if you have Splunk Enterprise, using the CLI or by editing the indexes.conf configuration file.
2. When you configure the data inputs, send events to the test index. You can do this in Splunk Web. For each input, perform these steps:
   1. When you configure the input from the Add data page, check the More settings option. It reveals several new fields, including one called Index.
   2. From the Index drop-down list, select your test index. All events for that data input now go to that index.
   3. Repeat this process for each data input that you want to send to your test index.
3. When you search, specify the test index in your search command. By default, searches the main index. Use the index= command, like this:

index=test_index

When you search a test index for events coming in from your newly created input, change the time range for the fields side bar to '''Real-time > All time (real-time)'''. The resulting real-time search shows all events being written to that index regardless of the value of their extracted time stamp. This result is particularly useful if you're indexing historical data into your index that a search for '''Last hour''' or '''Real-time > 30 minute window''' wouldn't show.

To learn how to create and use custom indexes with Splunk Web, see Create custom indexes in the Splunk Enterprise Managing Indexers and Clusters of Indexers manual. You can also specify an index when you configure an input in the inputs.conf configuration file.

Delete indexed data and start over

If you want to clean out your test index and start over on Splunk Enterprise, use the CLI clean command, as described Remove indexes and indexed data in the Splunk Enterprise Managing Indexers and Clusters of Indexers manual.

Configure your inputs to use the default index

When you're satisfied with the test results and you're ready to start indexing for real, edit your data inputs so that they send data to the default main index instead of the test index. For each data input that you've already set up, follow the reversed steps that you took to set up the test index:

1. Go back to the place where you initially configured the input. For example, if you configured the input from the Add data page in Splunk Web, return to the configuration screen for that input:
   1. Select System > System configurations > Data inputs.
   2. Select the input data type to see a list of all configured inputs of that type.
   3. Select the specific data input that you want to edit. Selecting the input takes you to a screen where you can edit it.
   4. Select the Display advanced settings option. Go to the field named Index.
   5. In the Index drop-down list, select the main index. All events for that data input now go to that index.

If you instead used the inputs.conf file to configure an input, you can change the index directly in that file, as described Create custom indexes in the Splunk Enterprise Managing Indexers and Clusters of Indexers manual.

Now when you search, you no longer need to specify an index in the search command. By default, Splunk software searches the main index.