topic Re: Cluster master environment in Splunk Enterprise

Cluster master environment

Patrycja_K_ — Wed, 27 Mar 2024 15:43:16 GMT

I would like to ask about the server.conf and web.conf configuration files.
how to place them in a clustered environment where there are 3 indexers and the cluster master stands alone? thanks for the answers.

Re: Cluster master environment

meetmshah — Wed, 27 Mar 2024 17:17:02 GMT

Hello @Patrycja_K_ typically, server.conf and web.conf file is for below -

server.conf:
- This file contains configurations related to the Splunk server, such as network settings, authentication settings etc.
- You typically only need to manage this file on the cluster master.
web.conf:
- This file contains configurations for the Splunk Web interface, such as UI settings, SSL settings, and HTTP server settings.
- Similarly, you typically manage this file on the cluster master.

Can you please share if you have any specific question about server.conf and web.conf files?

Re: Cluster master environment

Patrycja_K_ — Wed, 27 Mar 2024 17:32:09 GMT

let's say that I have clustered for my indexers and now I want to change the configuration for peers regarding web.conf from the master node level (disable the indexers gui because there is now a cluster master manages them) and add config to server.conf from the cluster master level for the entire cluster.

Re: Cluster master environment

meetmshah — Wed, 27 Mar 2024 17:43:04 GMT

Ideally it should be managed locally in system/local - however, have you tried managing it through peer-apps? As peer-apps' Precedence will be as follow -

1. Peer-app local directories -- highest priority
2. System local directory
3. App local directories
4. Peer-app default directories
5. App default directories
6. System default directory -- lowest priority

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#Precedence_within_global_context.2C_indexer_cluster_peers_only

Please accept the solution and hit Karma, if this helps!