topic After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster? in Deployment Architecture

After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

prianticoy — Tue, 29 Sep 2020 08:24:32 GMT

Hi!!!

I have a big problem with the index replication in the Indexer cluster.

I add a new index in the indexes.conf file (splunk_home/etc/system/local). I did this in the master node, however, the index is not replicated into the peers (3 peers, repfactor=3)...

I already edit the indexes.conf in splunk_home/etc/system/master-apps/_cluster/local , and after that I restart the master node, but nothing works...

Do you have some tip for me?

Thanks!!!

Re: After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

prianticoy — Tue, 12 Jan 2016 01:12:03 GMT

I already distributed the config trouhg the master node...

Do you have some tip? please!

Re: After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

renjith_nair — Tue, 29 Sep 2020 08:21:55 GMT

The process to add a new index to indexer cluster is

Add the index details to $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf
Make sure that repFactor=auto in included in the index stanza
Distribute the new indexes.conf file to the peers by applying cluster bundle.

This will push the configuration to peers and indexes.conf in slave-apps directory of peers

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_configuration_bundle

Re: After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

prianticoy — Tue, 12 Jan 2016 13:13:45 GMT

Hi! and thanks for your answer!

However, I already did that, and didn't work...

Do you know some other troubleshoot for this issue?

Re: After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

renjith_nair — Wed, 13 Jan 2016 02:08:56 GMT

What's the status of cluster apply bundle command?
Check in your master's and indexer's log file to see if its throwing any errors for bundle distribution
Check in your indexer's slave-apps/_cluster/local or default directory if the indexes.conf has been updated

Re: After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

prianticoy — Wed, 13 Jan 2016 12:51:20 GMT

Hi, thanks for your time! I already configure the index and now replication is working fine.

Thanks!

Re: After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

renjith_nair — Wed, 13 Jan 2016 12:53:51 GMT

Just out of curiosity, what was the problem ?

Re: After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

gavsdavs_GR — Tue, 29 Sep 2020 13:43:12 GMT

Out of interest, is the _cluster directory there for some special system reason ?

We distribute indexes.conf and parsing apps for the indexers by putting them in apps under master-apps and we've never done anything with the files under _cluster.

You recommend putting configs in _cluster (in here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_configuration_bundle),

rather than appifying/containerizing all configs as per your normal best practice ?

It strikes me as something you (Splunk) are likely to update as you release new versions and add indexes (for example, _telemetry).

I'd call this a system directory, not a user manageable directory.

Soooo...I was just wondering why it's there.