Deployment Architecture

Migrating files from etc/system to slave-apps in cluster

brettcave
Builder

Hi, i was running a single indexer which has props / transforms in etc/system/local.

The indexer was migrated to an indexer cluster, with the other cluster nodes not having the configs. Data is only being sent to the old indexer (which is part of the ckuster).

What effect on incoming data would pushing modified props / tranforms from the cluster master's master-apps to slave apps on the indexers have? I.e. the node receiving data will have duplicate configs for a short period.

Props and transforms do event matching / tagging and regex search / replace.

0 Karma

nickhills
Ultra Champion

No Problem.

That would be the suggested route.
Duplicated configs in this case are no problem (especially if identical), but you would be well advised to remove the original system/local config once the cluster bundle has been applied.

If my comment helps, please give it a thumbs up!
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...