topic Re: Spunk indexes.conf by deployment server in Getting Data In

Splunk indexes.conf by deployment server

lmjoin — Thu, 30 Jan 2025 22:55:18 GMT

I have installed search head cluster and want pushing configuration by deployment server . But unable to find how to make and push indexes.conf to all indexers ( not in clustering ) . Thanks for reply in advance

Re: Spunk indexes.conf by deployment server

martin_mueller — Tue, 05 Jun 2018 12:14:24 GMT

Best practice would be to turn your indexers into an indexer cluster, and then push configuration to your indexers from the cluster master.

Re: Spunk indexes.conf by deployment server

lmjoin — Tue, 05 Jun 2018 12:21:06 GMT

That is true , here we need such configuration.

Re: Spunk indexes.conf by deployment server

lmjoin — Tue, 05 Jun 2018 12:30:24 GMT

We need to do here by deployment server

Re: Spunk indexes.conf by deployment server

martin_mueller — Tue, 05 Jun 2018 12:44:27 GMT

You can configure indexers to be deployment clients of your deployment server, but that's kinda what the cluster master is there for. For example, the cluster master will trigger a rolling restart when new configuration requires a restart - some indexers will always be there. The deployment server will cause all indexers to restart, possibly at the same time.

Who says you need to configure your indexers by deployment server? Ask them why you're not allowed to use best practices, and if they'll take responsibility when the entire indexing tier is down at the same time after a small configuration change.

Re: Spunk indexes.conf by deployment server

martin_mueller — Tue, 05 Jun 2018 14:30:06 GMT

If you're certain you need indexers as deployment clients (hint: you don't, you want a cluster) then you can turn on their deployment client the same way you turn it on for forwarders: via the CLI splunk set deploy-poll host:port or via deploymentclient.conf

Re: Spunk indexes.conf by deployment server

lmjoin — Wed, 06 Jun 2018 07:04:51 GMT

thanks for reply , how to do entry in which file for same

Re: Spunk indexes.conf by deployment server

DavidHourani — Wed, 06 Jun 2018 08:26:24 GMT

Hi lmjoin!

So you can push your indexes.conf from deployment server but make sure you include a metadata config file so that configuration is exported to system.

In the app you will use for indexes make a folder called metadata and add a local.meta file into it containing the following:

# Application-level permissions
[]
access = read : [ * ], write : [ admin]
export = system

Let me know if that works out for you!

Best regards,
David

Re: Spunk indexes.conf by deployment server

lmjoin — Tue, 29 Sep 2020 19:55:06 GMT

ALL
INDEXERS
[serverClass:all_indexer]

whitelist.0

whitelist.1

whitelist.2

whitelist.3

ALPD835.aldc.att.com

whitelist.4

ALPD836.aldc.att.com

restartSplunkd

true
[serverClass:all_indexer:app:ito_det_deploymentclient]
[serverClass:all_indexer:app:ito_det_indexer_base]
[serverClass:all_indexer:app:ito_det_indexes]
[serverClass:all_indexer:app:ito_det_license_slave]
[serverClass:all_indexer:app:ito_det_dbx_timezone]
[serverClass:all_indexer:app:Splunk_TA_nix]
[serverClass:all_indexer:app:TA-‐sos]

Re: Spunk indexes.conf by deployment server

lmjoin — Tue, 29 Sep 2020 19:55:15 GMT

i have what to add in serverclass.conf for indexers but unable to make to find location where i put indexes.conf for

ALL
INDEXERS
[serverClass:all_indexer]

whitelist.0

Hostname

whitelist.1

Hostname

whitelist.2

Hostname

whitelist.3

Hostname

whitelist.4

Hostname

restartSplunkd

Re: Spunk indexes.conf by deployment server

lmjoin — Wed, 06 Jun 2018 11:33:11 GMT

Please share indexes.conf location on deployment server

Re: Spunk indexes.conf by deployment server

DavidHourani — Wed, 06 Jun 2018 12:26:07 GMT

so you have to put indexes.conf in an application on $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local this app needs to be pushed from the deployment server to the indexer that needs to be configured as a deployment client.

Re: Spunk indexes.conf by deployment server

DavidHourani — Wed, 06 Jun 2018 17:00:19 GMT

@lmjoin, you don't need to edit your severclass manually. When you add your app to deployment-apps you can see it on the graphic interface under forwarder management on the deployment server. From there you can create the serverclass via GUI and add the app with indexes.conf in it and the indexers you wish to send it to 🙂

Re: Spunk indexes.conf by deployment server

martin_mueller — Wed, 06 Jun 2018 18:42:41 GMT

http://docs.splunk.com/Documentation/Splunk/7.1.1/Updating/Aboutdeploymentserver

Re: Spunk indexes.conf by deployment server

lmjoin — Thu, 07 Jun 2018 12:13:48 GMT

ok thanks , i will try and back

Re: Spunk indexes.conf by deployment server

lmjoin — Thu, 07 Jun 2018 15:06:52 GMT

one extra question , props.conf and transforms.conf are created $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local or it can be created by GUI

Re: Spunk indexes.conf by deployment server

DavidHourani — Fri, 08 Jun 2018 05:49:25 GMT

You have to have the files manually added to deployment apps. You can however create on GUI and copy paste into deployment apps.

Re: Spunk indexes.conf by deployment server

lmjoin — Sat, 09 Jun 2018 10:03:53 GMT

how to create props.conf and transforms.conf by GUI , any idea , thanks in advance

Re: Spunk indexes.conf by deployment server

DavidHourani — Sat, 09 Jun 2018 10:14:36 GMT

yeah, simply create a new data input and when you create it add a new sourcetype and configure it as needed. that will generate the files for you ^^

Re: Spunk indexes.conf by deployment server

lmjoin — Mon, 11 Feb 2019 04:11:14 GMT

Thanks for reply ,

I have put indexes.conf , props.conf and transforms.conf on $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local on deployment server and push , it showing successfully done not found no indexes.conf,props.conf and transforms.conf on indexer ( independent not in clustering ) . Please help me.
Thanks
Lalit