Splunk indexes.conf by deployment server

[lmjoin]

I have installed search head cluster and want pushing configuration by deployment server . But unable to find how to make and push indexes.conf to all indexers ( not in clustering ) . Thanks for reply in advance

[martin_mueller]

Apply shcluster-bundle applies a bundle to your searchhead cluster. Read the deployment server docs linked to earlier.

[lmjoin]

i have what to add in serverclass.conf for indexers but unable to make to find location where i put indexes.conf for

ALL
INDEXERS
[serverClass:all_indexer]

whitelist.0

Hostname

whitelist.1

Hostname

whitelist.2

Hostname

whitelist.3

Hostname

whitelist.4

Hostname

restartSplunkd

true
[serverClass:all_indexer:app:ito_det_deploymentclient]
[serverClass:all_indexer:app:ito_det_indexer_base]
[serverClass:all_indexer:app:ito_det_indexes]
[serverClass:all_indexer:app:ito_det_license_slave]
[serverClass:all_indexer:app:ito_det_dbx_timezone]
[serverClass:all_indexer:app:Splunk_TA_nix]
[serverClass:all_indexer:app:TA-­‐sos]

[lmjoin]

ALL
INDEXERS
[serverClass:all_indexer]

whitelist.0

HN

whitelist.1

HN

whitelist.2

HN

whitelist.3

ALPD835.aldc.att.com

whitelist.4

ALPD836.aldc.att.com

restartSplunkd

true
[serverClass:all_indexer:app:ito_det_deploymentclient]
[serverClass:all_indexer:app:ito_det_indexer_base]
[serverClass:all_indexer:app:ito_det_indexes]
[serverClass:all_indexer:app:ito_det_license_slave]
[serverClass:all_indexer:app:ito_det_dbx_timezone]
[serverClass:all_indexer:app:Splunk_TA_nix]
[serverClass:all_indexer:app:TA-­‐sos]

[martin_mueller]

Best practice would be to turn your indexers into an indexer cluster, and then push configuration to your indexers from the cluster master.

[martin_mueller]

http://docs.splunk.com/Documentation/Splunk/7.1.1/Updating/Aboutdeploymentserver

[martin_mueller]

If you're certain you need indexers as deployment clients (hint: you don't, you want a cluster) then you can turn on their deployment client the same way you turn it on for forwarders: via the CLI splunk set deploy-poll host:port or via deploymentclient.conf

[lmjoin]

thanks for reply , how to do entry in which file for same

[martin_mueller]

You can configure indexers to be deployment clients of your deployment server, but that's kinda what the cluster master is there for. For example, the cluster master will trigger a rolling restart when new configuration requires a restart - some indexers will always be there. The deployment server will cause all indexers to restart, possibly at the same time.

Who says you need to configure your indexers by deployment server? Ask them why you're not allowed to use best practices, and if they'll take responsibility when the entire indexing tier is down at the same time after a small configuration change.

[lmjoin]

We need to do here by deployment server

[lmjoin]

That is true , here we need such configuration.