After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

[prianticoy]

Hi!!!

I have a big problem with the index replication in the Indexer cluster.

I add a new index in the indexes.conf file (splunk_home/etc/system/local). I did this in the master node, however, the index is not replicated into the peers (3 peers, repfactor=3)...

I already edit the indexes.conf in splunk_home/etc/system/master-apps/_cluster/local , and after that I restart the master node, but nothing works...

Do you have some tip for me?

Thanks!!!

[gavsdavs_GR]

Out of interest, is the _cluster directory there for some special system reason ?

We distribute indexes.conf and parsing apps for the indexers by putting them in apps under master-apps and we've never done anything with the files under _cluster.

You recommend putting configs in _cluster (in here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_co...),

• rather than appifying/containerizing all configs as per your normal best practice ?

It strikes me as something you (Splunk) are likely to update as you release new versions and add indexes (for example, _telemetry).

I'd call this a system directory, not a user manageable directory.

Soooo...I was just wondering why it's there.

[renjith_nair · Accepted solution]

The process to add a new index to indexer cluster is

1. Add the index details to $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf
2. Make sure that repFactor=auto in included in the index stanza
3. Distribute the new indexes.conf file to the peers by applying cluster bundle.

This will push the configuration to peers and indexes.conf in slave-apps directory of peers

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_co...

[prianticoy]

Hi! and thanks for your answer!

However, I already did that, and didn't work...

Do you know some other troubleshoot for this issue?

[renjith_nair]

What's the status of cluster apply bundle command?
Check in your master's and indexer's log file to see if its throwing any errors for bundle distribution
Check in your indexer's slave-apps/_cluster/local or default directory if the indexes.conf has been updated

[prianticoy]

Hi, thanks for your time! I already configure the index and now replication is working fine.

Thanks!

[renjith_nair]

Just out of curiosity, what was the problem ?

[prianticoy]

I already distributed the config trouhg the master node...

Do you have some tip? please!