How to configure a new index via Splunk Web in an indexer clustering environment?

[horsefez]

Hi Splunkers!

I have a problem when I'm trying to distribute new indexes made via Splunk Web on the master-node of my indexer cluster.

I already know how to configure new indexes via indexes.conf on the master and how to distribute them via apply cluster-bundle.
This works fine!

Today, I tried to do the same thing via Splunk Web. The new index gets created and is displayed on the master, but when I'm trying to hit deploy, the following message shows:

In handler 'clustermastercontrol': No new bundle will be applied. The master and peers already have this bundle with bundle id = ....

How do I get the configured index onto the cluster peers?

Thanks in advance!

Kind regards,
pyro_wood

[frmaasdam]

You can creatie an app containing the needed indexes.conf and place it in de directory ../etc/master-apps/ on the master node.
An apply-cluster-bundle should distribute the indexes to all peer nodes.

[renjith_nair]

You can't create indexes using web in indexer cluster. See the doc http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes

Important: You cannot use Splunk Web or the CLI to configure index settings on peer nodes. You must edit indexes.conf directly

The index you have created is local for master and you shouldn't be using that index to store data , forward all data from master also to peer indexers instead

[lycollicott · Accepted solution]

Your master node should not have any indexes on it. The only way to create them on the peers is with indexes.conf and a bundle.
Sorry, dude.

[horsefez]

Thank you very much lycollicott. I miss those key information in the splunk docs.
Maybe I've overlooked it, but I think this information isn't in there.