Deployment Architecture

Index Clustering

teak421
Path Finder

Just got my license this past week and I've been having a blast setting up. Amazing program. Anyway, I'm running into an Index Cluster Question. I've got a separate Master Node and three indexers all in the same cluster. When I go to Master Node, I see all the Peers, Indexes and Search Heads. Under the Indexes tab, it only shows the _ internal indexes and main. Well, this doesn't seem right because on each of the indexers I've installed the same indexes.conf file. When I do a search from the search head with index = oswin, I do see data. Why then on the indexes page on the master node I do not see that index listed? Does that mean that index is NOT having its buckets replicated? I hope this makes sense, and apologies if it does not... only been at this for about a week. Thanks!

0 Karma
1 Solution

nickhills
Ultra Champion

No, this is totally normal.

Its a bit frustrating, but neither Cluster Masters nor Search Heads learn about available indexes from indexer peers. - At least not displayed in their local index-settings page.

Its a little counter intuitive, but the logic is that those indexes do not exist "on" those servers, which is why they are not visible in the settings.

The Cluster Master will show you all the indexes in the clustering settings pages, and you can use the DMC to see index stats.

In an ideal world, you have disabled the UI on indexer peers, but if this is enabled you can logon to a peer and look at its indexes - but don't change anything! - Thats why its a good idea to disable the UI!

Sometimes its useful to have a list of indexes available for configuring inputs especially if configuring something from the GUI. In those cases I normally add a small (5mb) dummy index on my HF/SH which means it will show up as a target for my inputs, which can help users make sure they are configuring their inputs against the right index.

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

No, this is totally normal.

Its a bit frustrating, but neither Cluster Masters nor Search Heads learn about available indexes from indexer peers. - At least not displayed in their local index-settings page.

Its a little counter intuitive, but the logic is that those indexes do not exist "on" those servers, which is why they are not visible in the settings.

The Cluster Master will show you all the indexes in the clustering settings pages, and you can use the DMC to see index stats.

In an ideal world, you have disabled the UI on indexer peers, but if this is enabled you can logon to a peer and look at its indexes - but don't change anything! - Thats why its a good idea to disable the UI!

Sometimes its useful to have a list of indexes available for configuring inputs especially if configuring something from the GUI. In those cases I normally add a small (5mb) dummy index on my HF/SH which means it will show up as a target for my inputs, which can help users make sure they are configuring their inputs against the right index.

If my comment helps, please give it a thumbs up!

teak421
Path Finder

UI disabled..!! 🙂

0 Karma

teak421
Path Finder

Thank you for the excellent run-down.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...