topic Re: Need help in Replication. in Deployment Architecture

Need help in Replication.

vikcee — Thu, 07 Nov 2019 08:03:56 GMT

Hello All,

I have created a Indexer cluster. In my master indexer I created one Index and added some data (/etc/master-app/_cluster/local). and pushed the index to all the peers. Index is replicated in all the indexer But data is showing in only master index. Now I want to add some data to all my indexer. What should I do?

Thanks
Vikash Gupta

Re: Need help in Replication.

p_gurav — Thu, 07 Nov 2019 08:14:48 GMT

Could you share the indexes.conf? Also, on which Splunk instance wrote your inputs.conf?

Re: Need help in Replication.

richgalloway — Thu, 07 Nov 2019 13:56:17 GMT

We may have a terminology problem. There is no such thing as a "master indexer". The instance in charge of an indexer cluster is the "Master Node" or "Cluster Master". A clustered indexer cannot serve as the Master.
Defining an index on the Master Node (MN) and pushing the configuration to the peers will define that index on all indexers.
All of your Splunk instances should be forwarding their output to the indexers. Not only does that make all Splunk logs searchable, but it also means data added on the MN or a Search Head will be sent to the indexers and replicated properly.

Re: Need help in Replication.

woodcock — Thu, 07 Nov 2019 15:01:14 GMT

There is no such thing as a Master Indexer. You should have a created an app inside of master-apps on the Cluster Master that contains an indexes.conf file. DO NOT create any splunk configuration files for this directly on any indexers. Then push out the indexes.conf app (which has the file) using the cluster commands on the Cluster Master. This will cause a rolling restart on the Indexers once they receive the new configurations, after which you will be able to send data to the new index on the indexers.