Deployment Architecture

How to configure a new index via Splunk Web in an indexer clustering environment?

horsefez
Motivator

Hi Splunkers!

I have a problem when I'm trying to distribute new indexes made via Splunk Web on the master-node of my indexer cluster.

I already know how to configure new indexes via indexes.conf on the master and how to distribute them via apply cluster-bundle.
This works fine!

Today, I tried to do the same thing via Splunk Web. The new index gets created and is displayed on the master, but when I'm trying to hit deploy, the following message shows:

In handler 'clustermastercontrol': No new bundle will be applied. The master and peers already have this bundle with bundle id = ....

How do I get the configured index onto the cluster peers?

Thanks in advance!

Kind regards,
pyro_wood

0 Karma
1 Solution

lycollicott
Motivator

Your master node should not have any indexes on it. The only way to create them on the peers is with indexes.conf and a bundle.
Sorry, dude.

View solution in original post

0 Karma

frmaasdam
Path Finder

You can creatie an app containing the needed indexes.conf and place it in de directory ../etc/master-apps/ on the master node.
An apply-cluster-bundle should distribute the indexes to all peer nodes.

0 Karma

renjith_nair
Legend

You can't create indexes using web in indexer cluster. See the doc http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes

Important: You cannot use Splunk Web or the CLI to configure index settings on peer nodes. You must edit indexes.conf directly

The index you have created is local for master and you shouldn't be using that index to store data , forward all data from master also to peer indexers instead

---
What goes around comes around. If it helps, hit it with Karma 🙂

lycollicott
Motivator

Your master node should not have any indexes on it. The only way to create them on the peers is with indexes.conf and a bundle.
Sorry, dude.

0 Karma

horsefez
Motivator

Thank you very much lycollicott. I miss those key information in the splunk docs.
Maybe I've overlooked it, but I think this information isn't in there.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...