Post-Installation Required Settings
After installing and configuring the Illumio App for Splunk, adjust the following settings.
Accelerate the Data Model
The Illumio App for Splunk ships with the Illumio data model acceleration disabled, as required for Splunk app certification. After you install the Illumio App for Splunk, you need to enable data model acceleration, which is used for data visualization in the dashboards. See Data Model and Data Model Acceleration.
Update Search Macros for Custom Index
If you choose a non-default index, you need to update the search macros to use the custom index. See Index, Source, and Source Types.