Add or edit a virtual index in Splunk Web

You can also add HDFS providers and virtual indexes by editing. See Set up a virtual index in the configuration file for instructions on setting up virtual indexes in the configuration file.

1. Select Settings > Virtual Indexes.

2. Click the Virtual Indexes tab and click New Virtual Index or click the name of the index you want to edit. The New/Edit Virtual Index page appears:

3. In the Name field, provide a name for your virtual index.

4. Select a Provider. To add a new provider, see Add an HDFS provider.

5. Provide the following path information:

• Path to data in HDFS: This is the path to the data that Splunk Analytics for Hadoop will be accessing and reporting on. For example:

/home/data/apache/logs/

• Recursively process the directory: Check this if you want to (recursively) include the content of sub directories.

• Whitelist: Provide a regex that matches the file path. You can specify regular expressions to filter in/out files (based on the full path) that should/not be considered part of the virtual index. A common use case for using it is to ignore temporary files, or files that are currently being written to. Keep in mind that ignore takes precedence over accept. For example: \.gz$

6. Check Customize timestamp format to open the controls that allow you to customize how data is collected based on timestamp information. Use simple date format to optionally customize the following:

• Time capturing Regex: Provide a regex that determines the earliest date/time that will be collected and processed based on timestamp. For example: /home/data/(\d+)/(\d+)/

• Time Format: For the earliest time above, provide a time format that describes how to interpret the extracted time string. For example: yyyyMMddHH

• Time Adjustment: Amount of time, in seconds, to add to the earliest time. Example (+7hrs): 25200

• Time Range: Provide a time range for which the index should collect data.

• Time Zone: Select your time zone.