Advice on migrating to clustered environment

[rgonzale6]

Greetings. Our environment currently has three load-balanced indexers. I've configured the three as clustered peers and that was pretty simply. However, out of the box it looks like only main and the internal indexes are replicating. It looks like I have to have an indexes.conf on my cluster master and push that out to my cluster peers. The problem is, the 3 boxes weren't built identically and as such the indexes, while the same on each box, are on different paths on each box. How can I push one indexes.conf from the cluster master out to my peers (and thus have all my indexes replicating properly) when the locations on each peer will be different?

[sowings · Accepted solution]

Splunk will layer together all of its configurations. Things in system/default have lowest precedence, then things in the apps/ folders, next slave-apps/ (if you're in a clustered environment) and finally system/local.

You should able to get away with a indexes.conf definition in the master-apps folder (shipped to the cluster peers by "splunk apply cluster-bundle") that just provides a new value for the repFactor setting:


[myindex]
repFactor = auto


Repeat for each of your indexes. The path definitions will still be contained in indexes.conf on the target indexer, so we won't be overriding or changing that.

You might also be able to get away with a simple default value for that field. The [default] stanza in indexes.conf has special meaning. It doesn't define an index called "default"; instead it sets the boilerplate settings for all other indexes.

[rgonzale6]

Fantastic, thanks!