topic Re: How to Not apply cluster-bundle in Getting Data In

How to Not apply cluster-bundle

Ed_Alias — Mon, 12 Oct 2015 07:26:54 GMT

Hi,

i am installing two new indexers for test, as test indexers they have very small disks.

As clustermember they get indexes.conf from the cluster-bundle, where _internal is set to keep logs for a year.

_internal configuration is made for my production splunk servers, how can i bypass the cluster bundle on the tests servers ?

Regards,
Edouard Alias

Re: How to Not apply cluster-bundle

Ed_Alias — Mon, 12 Oct 2015 07:39:25 GMT

i just need a differant config for _internal index on the two indexing tests servers...

Re: How to Not apply cluster-bundle

muebel — Mon, 12 Oct 2015 14:36:04 GMT

Hi Ed_alias, If your cluster apps are defining indexes in default only, I believe that you could put config into $SPLUNKHOME/etc/system/local/indexes.conf to override anything the cluster master puts out, but you'll want to be very careful about this. See : http://docs.splunk.com/Documentation/Splunk/6.1/admin/Wheretofindtheconfigurationfiles for more info on config precedence.

Alternatively, you could not add the indexers to the cluster, and leave them as independent indexers.

Let me know if this helps! 😄

Re: How to Not apply cluster-bundle

Ed_Alias — Mon, 12 Oct 2015 14:44:49 GMT

Hi,

believed slave apps is prioritary to system/local folder..

i thinks i'll have to let them out of cluster and use my master only as licence server ?

Re: How to Not apply cluster-bundle

muebel — Mon, 12 Oct 2015 15:04:41 GMT

good point, I updated the answer to clarify how this could work.

Yeah, you can still point the indexers to the master as your license server.