Deployment Architecture

Advice on migrating to clustered environment

rgonzale6
Path Finder

Greetings. Our environment currently has three load-balanced indexers. I've configured the three as clustered peers and that was pretty simply. However, out of the box it looks like only main and the internal indexes are replicating. It looks like I have to have an indexes.conf on my cluster master and push that out to my cluster peers. The problem is, the 3 boxes weren't built identically and as such the indexes, while the same on each box, are on different paths on each box. How can I push one indexes.conf from the cluster master out to my peers (and thus have all my indexes replicating properly) when the locations on each peer will be different?

Tags (1)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

Splunk will layer together all of its configurations. Things in system/default have lowest precedence, then things in the apps/ folders, next slave-apps/ (if you're in a clustered environment) and finally system/local.

You should able to get away with a indexes.conf definition in the master-apps folder (shipped to the cluster peers by "splunk apply cluster-bundle") that just provides a new value for the repFactor setting:


[myindex]
repFactor = auto

Repeat for each of your indexes. The path definitions will still be contained in indexes.conf on the target indexer, so we won't be overriding or changing that.

You might also be able to get away with a simple default value for that field. The [default] stanza in indexes.conf has special meaning. It doesn't define an index called "default"; instead it sets the boilerplate settings for all other indexes.

View solution in original post

sowings
Splunk Employee
Splunk Employee

Splunk will layer together all of its configurations. Things in system/default have lowest precedence, then things in the apps/ folders, next slave-apps/ (if you're in a clustered environment) and finally system/local.

You should able to get away with a indexes.conf definition in the master-apps folder (shipped to the cluster peers by "splunk apply cluster-bundle") that just provides a new value for the repFactor setting:


[myindex]
repFactor = auto

Repeat for each of your indexes. The path definitions will still be contained in indexes.conf on the target indexer, so we won't be overriding or changing that.

You might also be able to get away with a simple default value for that field. The [default] stanza in indexes.conf has special meaning. It doesn't define an index called "default"; instead it sets the boilerplate settings for all other indexes.

rgonzale6
Path Finder

Fantastic, thanks!

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...