Deployment Architecture

Index Clustering

teak421
Path Finder

Just got my license this past week and I've been having a blast setting up. Amazing program. Anyway, I'm running into an Index Cluster Question. I've got a separate Master Node and three indexers all in the same cluster. When I go to Master Node, I see all the Peers, Indexes and Search Heads. Under the Indexes tab, it only shows the _ internal indexes and main. Well, this doesn't seem right because on each of the indexers I've installed the same indexes.conf file. When I do a search from the search head with index = oswin, I do see data. Why then on the indexes page on the master node I do not see that index listed? Does that mean that index is NOT having its buckets replicated? I hope this makes sense, and apologies if it does not... only been at this for about a week. Thanks!

0 Karma
1 Solution

nickhills
Ultra Champion

No, this is totally normal.

Its a bit frustrating, but neither Cluster Masters nor Search Heads learn about available indexes from indexer peers. - At least not displayed in their local index-settings page.

Its a little counter intuitive, but the logic is that those indexes do not exist "on" those servers, which is why they are not visible in the settings.

The Cluster Master will show you all the indexes in the clustering settings pages, and you can use the DMC to see index stats.

In an ideal world, you have disabled the UI on indexer peers, but if this is enabled you can logon to a peer and look at its indexes - but don't change anything! - Thats why its a good idea to disable the UI!

Sometimes its useful to have a list of indexes available for configuring inputs especially if configuring something from the GUI. In those cases I normally add a small (5mb) dummy index on my HF/SH which means it will show up as a target for my inputs, which can help users make sure they are configuring their inputs against the right index.

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

No, this is totally normal.

Its a bit frustrating, but neither Cluster Masters nor Search Heads learn about available indexes from indexer peers. - At least not displayed in their local index-settings page.

Its a little counter intuitive, but the logic is that those indexes do not exist "on" those servers, which is why they are not visible in the settings.

The Cluster Master will show you all the indexes in the clustering settings pages, and you can use the DMC to see index stats.

In an ideal world, you have disabled the UI on indexer peers, but if this is enabled you can logon to a peer and look at its indexes - but don't change anything! - Thats why its a good idea to disable the UI!

Sometimes its useful to have a list of indexes available for configuring inputs especially if configuring something from the GUI. In those cases I normally add a small (5mb) dummy index on my HF/SH which means it will show up as a target for my inputs, which can help users make sure they are configuring their inputs against the right index.

If my comment helps, please give it a thumbs up!

teak421
Path Finder

UI disabled..!! 🙂

0 Karma

teak421
Path Finder

Thank you for the excellent run-down.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...