Anexo C - indexes.conf

Ruta final en este PC: C:\Program Files\Splunk\etc\apps\SOC-Windows-Local\local\indexes.conf Rol: define los índices win_* en el indexer.

[win_security]
homePath   = $SPLUNK_DB/win_security/db
coldPath   = $SPLUNK_DB/win_security/colddb
thawedPath = $SPLUNK_DB/win_security/thaweddb
maxTotalDataSizeMB = 5000
 
[win_system]
homePath   = $SPLUNK_DB/win_system/db
coldPath   = $SPLUNK_DB/win_system/colddb
thawedPath = $SPLUNK_DB/win_system/thaweddb
maxTotalDataSizeMB = 5000
 
[win_app]
homePath   = $SPLUNK_DB/win_app/db
coldPath   = $SPLUNK_DB/win_app/colddb
thawedPath = $SPLUNK_DB/win_app/thaweddb
maxTotalDataSizeMB = 5000
 
[win_setup]
homePath   = $SPLUNK_DB/win_setup/db
coldPath   = $SPLUNK_DB/win_setup/colddb
thawedPath = $SPLUNK_DB/win_setup/thaweddb
maxTotalDataSizeMB = 5000
 
[win_sysmon]
homePath   = $SPLUNK_DB/win_sysmon/db
coldPath   = $SPLUNK_DB/win_sysmon/colddb
thawedPath = $SPLUNK_DB/win_sysmon/thaweddb
maxTotalDataSizeMB = 5000
 
[win_powershell]
homePath   = $SPLUNK_DB/win_powershell/db
coldPath   = $SPLUNK_DB/win_powershell/colddb
thawedPath = $SPLUNK_DB/win_powershell/thaweddb
maxTotalDataSizeMB = 5000
 
[win_defender]
homePath   = $SPLUNK_DB/win_defender/db
coldPath   = $SPLUNK_DB/win_defender/colddb
thawedPath = $SPLUNK_DB/win_defender/thaweddb
maxTotalDataSizeMB = 5000
 
[win_wmi]
homePath   = $SPLUNK_DB/win_wmi/db
coldPath   = $SPLUNK_DB/win_wmi/colddb
thawedPath = $SPLUNK_DB/win_wmi/thaweddb
maxTotalDataSizeMB = 5000
 
[win_rdp]
homePath   = $SPLUNK_DB/win_rdp/db
coldPath   = $SPLUNK_DB/win_rdp/colddb
thawedPath = $SPLUNK_DB/win_rdp/thaweddb
maxTotalDataSizeMB = 5000
 
[win_tasks]
homePath   = $SPLUNK_DB/win_tasks/db
coldPath   = $SPLUNK_DB/win_tasks/colddb
thawedPath = $SPLUNK_DB/win_tasks/thaweddb
maxTotalDataSizeMB = 5000
 
[win_print]
homePath   = $SPLUNK_DB/win_print/db
coldPath   = $SPLUNK_DB/win_print/colddb
thawedPath = $SPLUNK_DB/win_print/thaweddb
maxTotalDataSizeMB = 5000
 
[win_perfmon]
homePath   = $SPLUNK_DB/win_perfmon/db
coldPath   = $SPLUNK_DB/win_perfmon/colddb
thawedPath = $SPLUNK_DB/win_perfmon/thaweddb
maxTotalDataSizeMB = 5000
 
[win_fim]
homePath   = $SPLUNK_DB/win_fim/db
coldPath   = $SPLUNK_DB/win_fim/colddb
thawedPath = $SPLUNK_DB/win_fim/thaweddb
maxTotalDataSizeMB = 5000
 
[win_status]
homePath   = $SPLUNK_DB/win_status/db
coldPath   = $SPLUNK_DB/win_status/colddb
thawedPath = $SPLUNK_DB/win_status/thaweddb
maxTotalDataSizeMB = 5000

Cómo se generó correctamente en este PC

El primer intento falló: usamos un StringBuilder en PowerShell donde $SPLUNK_DB se expandió al valor de la variable de entorno (generando rutas absolutas pre-combinadas con comillas inválidas). Splunk mostraba:

Problem parsing indexes.conf: Cannot load IndexConfig:
Cannot create index 'win_app': path of homePath must be absolute
('"C:\Program Files\Splunk\var\lib\splunk/win_app/db')

Solución correcta con here-string single-quoted (no interpola $):

$tpl = @'
[{NAME}]
homePath   = $SPLUNK_DB/{NAME}/db
coldPath   = $SPLUNK_DB/{NAME}/colddb
thawedPath = $SPLUNK_DB/{NAME}/thaweddb
maxTotalDataSizeMB = 5000
 
'@
$content = ''
foreach ($i in 'win_security','win_system','win_app','win_setup','win_sysmon',
               'win_powershell','win_defender','win_wmi','win_rdp','win_tasks',
               'win_print','win_perfmon','win_fim','win_status') {
    $content += ($tpl -replace '\{NAME\}',$i)
}
Set-Content -Path 'C:\Program Files\Splunk\etc\apps\SOC-Windows-Local\local\indexes.conf' `
            -Value $content -Encoding UTF8

Ver Troubleshooting.

Modificar el tamaño de cada índice

Cambia maxTotalDataSizeMB (o añade maxDataSize y maxHotBuckets). Tras edición:

& 'C:\Program Files\Splunk\bin\splunk.exe' restart

Volver a: 00 - MOC Monitorización PC Local