About maintaining indexes.conf

[masakazu]

In an indexed cluster environment, I set the following stanza configuration in the deployment server's serverclass.conf file, but

[Server class: splunk_indexer_master_cluster]
stateOnClient = noop
Whitelist = <ClusterManagerA>

The _cluster folder under manager-app disappeared along with his Indexes.conf inside it.
Fortunately, Indexes.conf remained in the cluster's peer app, so this was not a problem.

If I want to use stateOnClient = noop, how should I maintain Indexes.conf deployed to the cluster on the cluster master?

[masakazu]

Grazie Signor Gcusello!

1. Create an APP with index.con in DS
2. After deploying to the manager, received by manager-app
3. peer received on peer-app.

Also, is it standard specification for the manager server to receive data using manager-app?

best regards

[gcusello]

Hi @masakazu,

in the deploymentclient.conf file of the Cluster Master, you have to add:

repositoryLocation = $SPLUNK_HOME/etc/managed-apps

in this way the deployment Server, only on the Cluster Master, doesn't deploy the apps into apps but in managed-apps folder.

Then you have to push it by GUI (I'm not sure that's possible to automate it by DS).

Put attention that this deploymentclient.conf must be different thant the one on the other clients.

Ciao.

Giuseppe

[gcusello]

Hi @masakazu ,

let me understand: do you want to manage the Cluster Manager using the DS or do you want to directly manage the Indexers using the DS?

the second option isn't possible.

For the first it's always better to deploy to the Cluster Manager apps (e.g. TA_indexes) and not the indexes.conf file in _cluster.

Anyway, you have to configure as deployment folder the $SPLUNK_HOME/etc/managed-apps folder.

Ciao.

Giuseppe