Deployment Architecture

Migrating files from etc/system to slave-apps in cluster

brettcave
Builder

Hi, i was running a single indexer which has props / transforms in etc/system/local.

The indexer was migrated to an indexer cluster, with the other cluster nodes not having the configs. Data is only being sent to the old indexer (which is part of the ckuster).

What effect on incoming data would pushing modified props / tranforms from the cluster master's master-apps to slave apps on the indexers have? I.e. the node receiving data will have duplicate configs for a short period.

Props and transforms do event matching / tagging and regex search / replace.

0 Karma

nickhills
Ultra Champion

No Problem.

That would be the suggested route.
Duplicated configs in this case are no problem (especially if identical), but you would be well advised to remove the original system/local config once the cluster bundle has been applied.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...