Deployment Architecture

Migrating files from etc/system to slave-apps in cluster

brettcave
Builder

Hi, i was running a single indexer which has props / transforms in etc/system/local.

The indexer was migrated to an indexer cluster, with the other cluster nodes not having the configs. Data is only being sent to the old indexer (which is part of the ckuster).

What effect on incoming data would pushing modified props / tranforms from the cluster master's master-apps to slave apps on the indexers have? I.e. the node receiving data will have duplicate configs for a short period.

Props and transforms do event matching / tagging and regex search / replace.

0 Karma

nickhills
Ultra Champion

No Problem.

That would be the suggested route.
Duplicated configs in this case are no problem (especially if identical), but you would be well advised to remove the original system/local config once the cluster bundle has been applied.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...