Deployment Architecture

Migrating files from etc/system to slave-apps in cluster

brettcave
Builder

Hi, i was running a single indexer which has props / transforms in etc/system/local.

The indexer was migrated to an indexer cluster, with the other cluster nodes not having the configs. Data is only being sent to the old indexer (which is part of the ckuster).

What effect on incoming data would pushing modified props / tranforms from the cluster master's master-apps to slave apps on the indexers have? I.e. the node receiving data will have duplicate configs for a short period.

Props and transforms do event matching / tagging and regex search / replace.

0 Karma

nickhills
Ultra Champion

No Problem.

That would be the suggested route.
Duplicated configs in this case are no problem (especially if identical), but you would be well advised to remove the original system/local config once the cluster bundle has been applied.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...