Deployment Architecture

Does indexes.conf get generated as part of the initialization of an indexer and/or the initialization of an indexer cluster?

transtrophe
Communicator

I am just building an indexer cluster with replication factor of 9 using 15 indexers configured as peers on the master. Running Splunk 6.2.2 on Debian hosts with Debian upgraded to current rev. This all sets up correctly except for one factor: I don't have an indexes.conf anywhere on either the master or the peers. Is this expected when first setting up the cluster?

0 Karma
1 Solution

Steve_G_
Splunk Employee
Splunk Employee

Did you look in the default location on the peer nodes ($SPLUNK_HOME/etc/slave-apps/_cluster/default)? There should be an indexes.conf file there.

See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Configurethepeerindexes and
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Updatepeerconfigurations#On_the_peers

View solution in original post

Steve_G_
Splunk Employee
Splunk Employee

Did you look in the default location on the peer nodes ($SPLUNK_HOME/etc/slave-apps/_cluster/default)? There should be an indexes.conf file there.

See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Configurethepeerindexes and
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Updatepeerconfigurations#On_the_peers

Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...