Deployment Architecture

Does indexes.conf get generated as part of the initialization of an indexer and/or the initialization of an indexer cluster?

transtrophe
Communicator

I am just building an indexer cluster with replication factor of 9 using 15 indexers configured as peers on the master. Running Splunk 6.2.2 on Debian hosts with Debian upgraded to current rev. This all sets up correctly except for one factor: I don't have an indexes.conf anywhere on either the master or the peers. Is this expected when first setting up the cluster?

0 Karma
1 Solution

Steve_G_
Splunk Employee
Splunk Employee

Did you look in the default location on the peer nodes ($SPLUNK_HOME/etc/slave-apps/_cluster/default)? There should be an indexes.conf file there.

See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Configurethepeerindexes and
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Updatepeerconfigurations#On_the_peers

View solution in original post

Steve_G_
Splunk Employee
Splunk Employee

Did you look in the default location on the peer nodes ($SPLUNK_HOME/etc/slave-apps/_cluster/default)? There should be an indexes.conf file there.

See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Configurethepeerindexes and
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Updatepeerconfigurations#On_the_peers

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...