Deployment Architecture

How to configure a new index via Splunk Web in an indexer clustering environment?

horsefez
SplunkTrust
SplunkTrust

Hi Splunkers!

I have a problem when I'm trying to distribute new indexes made via Splunk Web on the master-node of my indexer cluster.

I already know how to configure new indexes via indexes.conf on the master and how to distribute them via apply cluster-bundle.
This works fine!

Today, I tried to do the same thing via Splunk Web. The new index gets created and is displayed on the master, but when I'm trying to hit deploy, the following message shows:

In handler 'clustermastercontrol': No new bundle will be applied. The master and peers already have this bundle with bundle id = ....

How do I get the configured index onto the cluster peers?

Thanks in advance!

Kind regards,
pyro_wood

0 Karma
1 Solution

lycollicott
Motivator

Your master node should not have any indexes on it. The only way to create them on the peers is with indexes.conf and a bundle.
Sorry, dude.

View solution in original post

0 Karma

frmaasdam
Path Finder

You can creatie an app containing the needed indexes.conf and place it in de directory ../etc/master-apps/ on the master node.
An apply-cluster-bundle should distribute the indexes to all peer nodes.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can't create indexes using web in indexer cluster. See the doc http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes

Important: You cannot use Splunk Web or the CLI to configure index settings on peer nodes. You must edit indexes.conf directly

The index you have created is local for master and you shouldn't be using that index to store data , forward all data from master also to peer indexers instead

Happy Splunking!

lycollicott
Motivator

Your master node should not have any indexes on it. The only way to create them on the peers is with indexes.conf and a bundle.
Sorry, dude.

0 Karma

horsefez
SplunkTrust
SplunkTrust

Thank you very much lycollicott. I miss those key information in the splunk docs.
Maybe I've overlooked it, but I think this information isn't in there.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...