Configure Global settings for the Splunk Add-on for Microsoft Cloud Services¶
Configure Global settings using Splunk Web¶
To configure global settings in Splunk Web, perform the following steps:
- In Splunk Web, click Splunk Add-on for Microsoft Cloud Services in the navigation bar.
- Navigate to the Configuration page.
- Click on Global settings.
- Use the following table to complete the global settings parameter configuration.
The modinputs need to be re-enabled when global settings are modified.
| Argument in configuration file | Field in Splunk Web | Description |
|---|---|---|
worker_threads_num |
Number of worker threads | Amount of workers responsible for collecting the data from individual blob simultaneously. It is used for tuning the parallel processing of Storage Blobs. The default value is 10. |
get_blob_batch_size |
Batch size of append blobs threads | Amount of bytes to be downloaded in a batch for append blobs. This attribute helps in controlling the size of each download operation. It is used in Storage Blob input. The default value is 120000 bytes. |
query_entities_page_size |
Entities page size per query | Amount of entities to be retrieved per page when querying entities from a Storage Table. It helps in controlling the amount of data fetched in each query operation. It is used in Storage Table input. The default value is 1000. |
event_cnt_per_item |
Event counts per item | Amount of entities to be processed and converted into events in a single batch. This attribute helps in controlling the batch size for event processing for Storage Table. The default value is 100. |
query_end_time_offset |
Offset of the query end time | The offset in seconds from the current time to determine the end time for querying entities. This attribute helps in setting a time window for the data collection process. It is used in Storage Table and Azure Audit inputs. The default value is 180 seconds. |
Configure Global settings using configuration file¶
To configure global seetings manually, create a stanza using the following template and add it to $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_mscs_settings.conf. If the file or path does not exist, create it.
[performance_tuning_settings]
worker_threads_num = <value>
get_blob_batch_size = <value>
query_entities_page_size = <value>
event_cnt_per_item = <value>
query_end_time_offset = <value>