All Apps and Add-ons

Installing the Splunk Add-On for Unix and Linux in an indexer cluster, do I have to enable repFactor=auto?

amielke
Communicator

I will install the app Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833/ ) in an indexer cluster. The inputs are described in the documentation, but the index is not described.

Must I use repFactor = auto and create a new file in the local folder?

0 Karma
1 Solution

lguinn2
Legend

Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix and SA-nixboth have index definitions.

View solution in original post

lguinn2
Legend

Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix and SA-nixboth have index definitions.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.