How to create indexes to be replicated in an indexer clustering environment?

[Ahmedkhalil]

Hi All,

I have configured indexer clustering in Splunk, but I don't know how to create indexes that are replicated in this cluster.

[Steve_G_ · Accepted solution]

This topic addresses in detail the issue of how to configure indexes in a cluster:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Indexer/Configurethepeerindexes

[john_glasscock]

Trying to follow the document.... which file do you have to manually update with the new index?

Splunkhome/etc/master-apps/_cluster/local/(server.conf) sorry I ment indexes.conf on the master node?

Then reapply the cluster?

[Steve_G_]

You create indexes in indexes.conf, not server.conf. You update the file on the master node and then use the CLI command 'splunk apply cluster-bundle' to deploy the updates to the peer nodes.

For details on updating configurations via that command, see: http://docs.splunk.com/Documentation/Splunk/6.3.1/Indexer/Updatepeerconfigurations

(referenced from the 'configure peer indexes' topic as well)

[Ahmedkhalil]

Ok thank you so much 🙂

[john_glasscock]

Sorry, I was asking Steve G., I am having the same issue. I have added the indexes there and it pushes out the other indexes, but does not show on the deployment server under indexing cluster page.

[Ahmedkhalil]

as i read from document you have first to send data to newly created indexes in order to see them

[Steve_G_]

Correct, see the note in this section:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Indexer/Configurethepeerindexes#View_the_indexes