I have set up Index peering cluster, where one node is index cluster master and rest two nodes are peer nodes.
Index has been successfully pushed and distributed among the peers.
Now I have added data input in one of the peer index node, now if i try to search it, is not visible ..on the other hand if i add data input in Index cluster manager (master) node , the data is visible on the search result?
Is it possible to distribute the data input to the peers? Or the data should always be pushed to Index master?
Here is what I have done and now what I want to achieve.
I created Index file in master index under $splunk_home/etc/master_apps and distrbuted among the peers.
Now I have created a normal file with content for Files & Directories data input. And I have created data input file in master. No I am able to see the contents of the file in master index search head.
But if I try to search same in Index peers , it is not visible. Ideally since the data is processed in peer index shouldnt it be viisble in peer index also.
So here my doubt is , if I want forward my log to splunk index master , will not it be visible in peers. And also is there anyway I can check whether the data is being processed by which indx peers?
if you use a master, you should only distribute your settings via the master server (usually $SPLUNK_HOME/etc/master-apps/). Because if you place your settings in one indexer manually, it will not get replicated to the other indexers.