Installing the Splunk Add-On for Unix and Linux in an indexer cluster, do I have to enable repFactor=auto?

[amielke]

I will install the app Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833/ ) in an indexer cluster. The inputs are described in the documentation, but the index is not described.

Must I use repFactor = auto and create a new file in the local folder?

[lguinn2 · Accepted solution]

Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix and SA-nixboth have index definitions.