I have a big problem with the index replication in the Indexer cluster.
I add a new index in the indexes.conf file (splunk_home/etc/system/local). I did this in the master node, however, the index is not replicated into the peers (3 peers, repfactor=3)...
I already edit the indexes.conf in splunkhome/etc/system/master-apps/cluster/local , and after that I restart the master node, but nothing works...
Do you have some tip for me?
I already distributed the config trouhg the master node...
Do you have some tip? please!
The process to add a new index to indexer cluster is
This will push the configuration to peers and indexes.conf in slave-apps directory of peers
Hi! and thanks for your answer!
However, I already did that, and didn't work...
Do you know some other troubleshoot for this issue?
What's the status of cluster apply bundle command?
Check in your master's and indexer's log file to see if its throwing any errors for bundle distribution
Check in your indexer's slave-apps/_cluster/local or default directory if the indexes.conf has been updated
Hi, thanks for your time! I already configure the index and now replication is working fine.
Just out of curiosity, what was the problem ?
Out of interest, is the _cluster directory there for some special system reason ?
We distribute indexes.conf and parsing apps for the indexers by putting them in apps under master-apps and we've never done anything with the files under _cluster.
You recommend putting configs in cluster (in here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distributetheconfigurationbundle),
It strikes me as something you (Splunk) are likely to update as you release new versions and add indexes (for example, _telemetry).
I'd call this a system directory, not a user manageable directory.
Soooo...I was just wondering why it's there.