Use custom metric indexes in Splunk App for Infrastructure

You can create custom indexes to store metrics data in the Splunk App for Infrastructure (SAI). For more information about creating custom indexes, see Create custom indexes.

The default index for metrics data in Splunk App for Infrastructure is em_metrics.

About the em_metrics source type

The em_metrics sourcetype is specifically for use with SAI, collectd, and the write_splunk plugin for collectd. This sourcetype performs important data transforms before indexing that is not available in the standard collectd sourcetype. Use the sourcetype in any custom metrics index that you create.

Use a custom metrics index in SAI

Include a custom metrics index in the metrics index macro so you can monitor hosts in your infrastructure that send data to the custom index. You can also add multiple metrics indexes.

1. Go to Settings > Advanced search and select Search macros.
2. For App, select Splunk App for Infrastructure (splunk_app_infrastructure).
3. Select the sai_metrics_indexes macro.
4. For the Definition, include the custom index you want to use. If you use multiple metrics indexes, add each one like this:

   index = linux_metrics OR index = windows_metrics
   

5. When you're done, save the macro.
6. Go to Settings > Data inputs and select HTTP Event Collector.
7. For the HEC token you use to collect metrics, update the allowed indexes list and specify a new Default Index.
8. When you're done, save the configuration.