Deployment Architecture

Index Replication Set Up- Why are my indexes not showing up?

SpockGin
Explorer

Hi All,

 

I have a blanket index cluster and a cluster manager.

I have added some config to push out an indexes.conf file with repFactor = auto.

The config applyed and rolled out sucessfully to the peer nodes. However, when i look at the SH on the Cluster Manager under, settings > indexer clustering, I cannot see the indexes as replicated.

On a clustered indexer, the config is as follows:

/opt/splunk/etc/peer-apps/_cluster/local/indexes.conf

 

 

 

 

[hoopla]
repFactor = auto
homePath = $SPLUNK_DB/hoopla/db
coldPath = $SPLUNK_DB/hoopla/colddb
thawedPath = $SPLUNK_DB/hoopla/thaweddb

 

 

 

 

 

SpockGin_0-1683033972420.png

 

I've tried a few variations and am a bit puzzled - Am I doing anything massivley wrong here? Should i see empty indexes here?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SpockGin,

I suppose that when you say " local Search Head", you're meaning the Master Node.

Anyway, have you alredy indexed some data? if not you don't see the index in the dashboard you shared.

See, using the Monitoring Console, if the index is correctly configured and if there are indexed data.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @SpockGin,

let me understand: where do you located the indexes.conf?

it must be in the Master Node at

/opt/splunk/etc/manager-apps/_cluster

 or in a dedicated app in 

/opt/splunk/etc/manager-apps/

Then you have to push it to the peers using a CLIcommand or using GUI.

Ciao.

Giuseppe

0 Karma

SpockGin
Explorer

Thank you for the reply.

So the indexes.conf file is located in: /opt/splunk/etc/manager-apps/_cluster/local/

This has been pushed to the peers and a rolling restart completed.

The indexes appear in the cluster under /opt/splunk/etc/peer-apps/_cluster/local/ as I would expect. So the cluster manager is working.

 

The problem i am having is creating new indexes for replication - The replicated indexes do show as replicated when i go to the indexer clustering, under settings on the local Search Head as in the screenshot.

 

Thanks

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SpockGin,

I suppose that when you say " local Search Head", you're meaning the Master Node.

Anyway, have you alredy indexed some data? if not you don't see the index in the dashboard you shared.

See, using the Monitoring Console, if the index is correctly configured and if there are indexed data.

Ciao.

Giuseppe

SpockGin
Explorer

So don't see the index in the dashboard you shared... Is this documented anywhere? I had a suspicion about this , though could not find anything in the docs.

I put some data in and it showed up which is great thanks.

Thanks again for your help.

SpockGin

 

0 Karma

SpockGin
Explorer

 

Hi gcusello,

 

Will replicated indexes only show if there is data then? Very curious. I'll try populating and see how it goes and set up the Monitoring Console.

 

Thanks for your time.

 

SpockGin

 


@gcusello wrote:

Hi @SpockGin,

I suppose that when you say " local Search Head", you're meaning the Master Node.

Anyway, have you alredy indexed some data? if not you don't see the index in the dashboard you shared.

See, using the Monitoring Console, if the index is correctly configured and if there are indexed data.

Ciao.

Giuseppe




 

 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...