topic Why isn't my index available for search in a distributed search environment? in Splunk Search

Why isn't my index available for search in a distributed search environment?

rubeniturrieta — Mon, 07 Sep 2015 18:19:52 GMT

Hi to everyone

I have a "Distributed Environment", with two indexers, and two search heads.
In the Master Node Indexer, I have an index called ftp, with a lot of data (I want this data available for distributed search). I've deployed "indexes.conf" to "search peers", and I can see the ftp index created in the search peer, but I can't see any data.

What can i do for have this data available for distributed search?

Regards

Re: Why isn't my index available for search in a distributed search environment?

dxu_splunk — Mon, 07 Sep 2015 21:47:26 GMT

2 possibilities 1) theres no data in your index (the index is not visible until there are buckets) 2) repFactor=auto wasn't set for the index (that sets the index to be a clustered index, see the indexes.conf.spec file)

see http://answers.splunk.com/answers/170721/why-cant-i-see-non-internal-indexes-in-cluster-mas.html#answer-170798

Re: Why isn't my index available for search in a distributed search environment?

esix_splunk — Tue, 08 Sep 2015 17:11:53 GMT

If you're working in a distributed environment, you need to create the index in the Cluster Master, under the master-apps, and then push that to all the cluster members.

Quick way to check this is to validate the existence of the index on all the cluster members. If you created this on one indexer, you're calling the master node, in the GUI under indexes, that wont replicate the index or the buckets to the other indexers.

Re: Why isn't my index available for search in a distributed search environment?

rubeniturrieta — Tue, 08 Sep 2015 19:05:50 GMT

And how can i create the index in the Cluster Master under the master-apps?, i've copied the search app folder in the master-apps folder, and then push it, but i think that something is wrong with that.

Re: Why isn't my index available for search in a distributed search environment?

rubeniturrieta — Tue, 08 Sep 2015 19:07:14 GMT

1) There's a lot of data in my index
2) repFactor is set in my index (SPLUNK_HOME/etc/apps/search)

Re: Why isn't my index available for search in a distributed search environment?

dxu_splunk — Tue, 08 Sep 2015 19:20:05 GMT

is it set for the indexers or the cluster master? (it needs to be set on all the indexers)

Re: Why isn't my index available for search in a distributed search environment?

dxu_splunk — Tue, 08 Sep 2015 19:22:52 GMT

http://docs.splunk.com/Documentation/Splunk/6.2.5/Indexer/Migratenon-clusteredindexerstoaclusteredenvironment

if its migrated from non-clustering, the old buckets will not replicate

Re: Why isn't my index available for search in a distributed search environment?

rubeniturrieta — Tue, 08 Sep 2015 19:32:48 GMT

Yes, you are right, is migrated from non-clustering.