Knowledge Management

How to create a new index(not peer index node) from distributed environment?

Leo_Yong
Explorer

The environment is working well, since we have already had some indexes created there, and running as expected. I just want to add another new index with new data.

Here is what I did:
1. create a new index(named: newindex) from search head web page. settings-->Indexes--> New Index
2. from heavy forwarder server, ..../etc/apps/search/local/inputs.conf, added:
[monitor://D:\filepath\filename*]
disable=0
host=a_new_hostname
index=newindex
sourcetype=a_old_sourcetype

  1. copy the log files to path: D:\filepath\

  2. restart splunk on heavy forwarder

After these steps, I could not get any data from search query(like using: index=newindex). By the way, I even couldn't find the index from indexer server web page(settings-->indexes).

Did I miss something? Please advise. Thanks.

Tags (1)
0 Karma
1 Solution

damann
Communicator

You have to create a new Index on the machine your forwarders send the data to.

Try to add a new index by using the WebUI from your Indexer(s) or by configuring indexes.conf on all your indexer.

I hope it works for you!

View solution in original post

0 Karma

damann
Communicator

You have to create a new Index on the machine your forwarders send the data to.

Try to add a new index by using the WebUI from your Indexer(s) or by configuring indexes.conf on all your indexer.

I hope it works for you!

0 Karma

Leo_Yong
Explorer

Thanks for your help. it's working now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...