Deployment Architecture

Index Clustering

Path Finder

Just got my license this past week and I've been having a blast setting up. Amazing program. Anyway, I'm running into an Index Cluster Question. I've got a separate Master Node and three indexers all in the same cluster. When I go to Master Node, I see all the Peers, Indexes and Search Heads. Under the Indexes tab, it only shows the _ internal indexes and main. Well, this doesn't seem right because on each of the indexers I've installed the same indexes.conf file. When I do a search from the search head with index = oswin, I do see data. Why then on the indexes page on the master node I do not see that index listed? Does that mean that index is NOT having its buckets replicated? I hope this makes sense, and apologies if it does not... only been at this for about a week. Thanks!

0 Karma
1 Solution

Ultra Champion

No, this is totally normal.

Its a bit frustrating, but neither Cluster Masters nor Search Heads learn about available indexes from indexer peers. - At least not displayed in their local index-settings page.

Its a little counter intuitive, but the logic is that those indexes do not exist "on" those servers, which is why they are not visible in the settings.

The Cluster Master will show you all the indexes in the clustering settings pages, and you can use the DMC to see index stats.

In an ideal world, you have disabled the UI on indexer peers, but if this is enabled you can logon to a peer and look at its indexes - but don't change anything! - Thats why its a good idea to disable the UI!

Sometimes its useful to have a list of indexes available for configuring inputs especially if configuring something from the GUI. In those cases I normally add a small (5mb) dummy index on my HF/SH which means it will show up as a target for my inputs, which can help users make sure they are configuring their inputs against the right index.

View solution in original post

Ultra Champion

No, this is totally normal.

Its a bit frustrating, but neither Cluster Masters nor Search Heads learn about available indexes from indexer peers. - At least not displayed in their local index-settings page.

Its a little counter intuitive, but the logic is that those indexes do not exist "on" those servers, which is why they are not visible in the settings.

The Cluster Master will show you all the indexes in the clustering settings pages, and you can use the DMC to see index stats.

In an ideal world, you have disabled the UI on indexer peers, but if this is enabled you can logon to a peer and look at its indexes - but don't change anything! - Thats why its a good idea to disable the UI!

Sometimes its useful to have a list of indexes available for configuring inputs especially if configuring something from the GUI. In those cases I normally add a small (5mb) dummy index on my HF/SH which means it will show up as a target for my inputs, which can help users make sure they are configuring their inputs against the right index.

View solution in original post

Path Finder

UI disabled..!! 🙂

0 Karma

Path Finder

Thank you for the excellent run-down.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!