I am not able to see custom indexes in cluster master

[btshivanand]

Hello Friends,

I am not able to see custom indexes in splunk cluster master.can you please help me?

Regards,Shivanand

[gcusello]

Hi @btshivanand,

only two questions:

• what do you mean with "custom indexes": not clustered indexes or  indexes cleated by you on the Master Node?
• what do you mean with "to see"? are you speaking in searches or on Master Node?

If you don't create an index on Master Node you cannot see it on the same MN, but only on indexers.

So check how you created indexes: indexes must be creted in indexes.con on Master Node, putting this conf file in $SPLUNK_HOME/etc/master-apps/_cluster or (better) in a dedicated app (called e.g. TA_Indexers) sited in $SPLUNK_HOME/etc/master-apps.

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Clusterdeploymentoverview

Ciao.

Giuseppe

[btshivanand]

Thanks for the reply.

Custom indexes are created by me on indexer master node.

i am speaking in master node.I am not able to see the custom indexes under settings -->indexer clustering---->indexes....

created custom indexes under below path

/opt/splunk/etc/master-apps/ee_all_indexes/local 

[gcusello]

Hi @btshivanand,

Did you inserted, in indexes stanzas

repFactor = auto

?

Ciao.

Giuseppe 

[btshivanand]

i am not using that .So i need to use that stanza for all the custom index.

[gcusello]

Hi @btshivanand,

yes you need!

I encountered the same problem in the past.

Ciao.

Giuseppe

[isoutamo]

That must be on every index definition on clustered indexers.

r. Ismo

[btshivanand]

Ok. Thanks .. Let me try