topic Re: Where to create an index in a clustered environment? in Getting Data In

Where to create an index in a clustered environment?

Prakash493 — Wed, 24 Apr 2019 17:49:00 GMT

Hi , i have a clustered environment
3 search heads and a cluster , in cluster i used to deployer apps
have 4 indexers and an indexer cluster master

i need to create an index but confuse where to create should i create it in indexer cluster master and push the bundle to other indexers if i do so is user able to search through search heads , or do i need to deploy it in search head deployer and push the updates ,

i am confused between these two.

Re: Where to create an index in a clustered environment?

codebuilder — Wed, 24 Apr 2019 21:34:49 GMT

You'll want to define your indexes on the master at /opt/splunk/etc/master-apps/_cluster/local/indexes.conf.

Then you can validate and push out the bundle to the indexers from the master with the following commands:

splunk validate cluster-bundle
splunk show cluster-bundle-status
splunk apply cluster-bundle

Re: Where to create an index in a clustered environment?

Prakash493 — Wed, 24 Apr 2019 21:44:51 GMT

Thanks but after that i dont need to do anything search head deployer , or when i search in search head it will come automatically right ?

Re: Where to create an index in a clustered environment?

codebuilder — Wed, 24 Apr 2019 21:47:04 GMT

The deployer is for pushing applications to your search head cluster.

The indexer master is for pushing indexes.conf to your indexer cluster (as well as other jobs it performs).

Re: Where to create an index in a clustered environment?

Prakash493 — Wed, 24 Apr 2019 21:48:18 GMT

Ok thank you ao much for info

Re: Where to create an index in a clustered environment?

codebuilder — Wed, 24 Apr 2019 21:50:06 GMT

Glad to help!

Re: Where to create an index in a clustered environment?

ddrillic — Wed, 24 Apr 2019 22:36:23 GMT

We had recently an interesting discussion about /opt/splunk/etc/master-apps/_cluster/local/indexes.conf at How to create a new index?

Re: Where to create an index in a clustered environment?

codebuilder — Wed, 30 Sep 2020 00:14:29 GMT

If you deploy indexes.conf via the master at /opt/splunk/etc/master-apps/_cluster/local/indexes.conf then your indexes.conf on the peer nodes (indexers) will reside at /opt/splunk/etc/slave-apps/_cluster/local/indexes.conf.

In a clustered environment, I'm not a fan of deploying indexes.conf any other way, though it can be done (e.g. in a custom app).
If that app gets deleted, or you inadvertently deploy with the app directory missing, or wrong permissions, etc. then you're going to have problems.

The /opt/splunk/etc/master-apps/_cluster/local/ is a special directory intended just for this purpose, and is documented as such:
https://docs.splunk.com/Documentation/Splunk/7.0.4/Indexer/Updatepeerconfigurations

Re: Where to create an index in a clustered environment?

Prakash493 — Thu, 25 Apr 2019 16:54:19 GMT

i have seen in my splunk environment all the indexes under at /opt/splunk/etc/master-apps/(app name)/local then indexes are their ,should i create here or this location opt/splunk/etc/master-apps/_cluster/local/indexes.conf. , i am not seeing any indexes here ?

Re: Where to create an index in a clustered environment?

euriska — Thu, 14 Jul 2022 20:07:43 GMT

Just a footnote, mine replicated and looked like they should be working until I realized I spelled the filename indexs.conf instead of indexes.conf