topic Re: Install ES on an Indexers Cluster in Splunk Enterprise Security

Install ES on an Indexers Cluster

gcusello — Wed, 30 Sep 2020 02:14:21 GMT

Hi at all,
probably it's a stupid question, but I don't know very well if ES has special requirements for Indexers Clusters and documentation doesn't help me.
I took in charge a Splunk installation where I found an Indexers Cluster where is installed the Splunk_TA_ForIndexers containing the indexes.conf file for ES correctly deployed using Master Node.
The problem is that in indexes.conf there isn't the clause repFactor = auto in indexes stanzas, so indexes aren't replicated between the cluster!
I know that old events aren't replicated between Indexers, so what it will happen if I insert the clause in indexes.conf?

Thank you for your help.

Bye.
Giuseppe

Re: Install ES on an Indexers Cluster

adonio — Fri, 20 Sep 2019 15:51:16 GMT

from the moment you insert the clause, data will replicate according to policies

Re: Install ES on an Indexers Cluster

smoir_splunk — Wed, 30 Sep 2020 02:19:04 GMT

If you want to modify indexes.conf to add repFactor = auto, follow these steps to recreate the Splunk_TA_ForIndexers and modify the indexes.conf outputted in that package, then deploy that updated package to your indexer cluster.
https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallTechnologyAdd-ons#Create_the_Splunk_TA_ForIndexers_and_manage_deployment_manually

The likely reason this is not set to auto is because repFactor is set to 0 by default, and the Splunk_TA_ForIndexers indexes.conf file combines the indexes.conf files in the add-ons selected when the TA is created. So if the indexes.conf files in those add-ons weren't set to replicate, it wouldn't get added.

I hope this helps!

Re: Install ES on an Indexers Cluster

edoardo_vicendo — Wed, 24 Mar 2021 17:36:47 GMT

I think that in an Indexer Cluster by default all the Splunk "internal" indexes should have repFactor=auto, at least under /opt/splunk/etc/master-apps/_cluster/default/indexes.conf

I opened the following Splunk Idea to ask for the implementation:

https://ideas.splunk.com/ideas/EID-I-898