topic Re: Creating index centrally in Getting Data In

Creating index centrally

echalex — Thu, 12 Apr 2012 14:50:18 GMT

Hi,

Is there any way of creating indexes on several indexers centrally? For a fairly small indexer-farm, it isn't much hassle to do it manually, but for several servers, it might be easier and more resistant to human error to do it centrally.

Re: Creating index centrally

BobM — Thu, 12 Apr 2012 15:21:18 GMT

I would recommend you look at deployment server. You can set one server to be master. Put the indexes.conf into an app called "indexer" set it to deploy the app whenever you add new indexes.

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutdeploymentserver

Re: Creating index centrally

echalex — Fri, 13 Apr 2012 05:59:43 GMT

Thanks! I do have a deployment set up, so that seems like a plausible solution. I thought about this, but I haven't found any mention of it, so I wanted to ask first.