Deployment Architecture

Need help in Replication.

vikcee
Path Finder

Hello All,

I have created a Indexer cluster. In my master indexer I created one Index and added some data (/etc/master-app/_cluster/local). and pushed the index to all the peers. Index is replicated in all the indexer But data is showing in only master index. Now I want to add some data to all my indexer. What should I do?

Thanks
Vikash Gupta

0 Karma
1 Solution

woodcock
Esteemed Legend

There is no such thing as a Master Indexer. You should have a created an app inside of master-apps on the Cluster Master that contains an indexes.conf file. DO NOT create any splunk configuration files for this directly on any indexers. Then push out the indexes.conf app (which has the file) using the cluster commands on the Cluster Master. This will cause a rolling restart on the Indexers once they receive the new configurations, after which you will be able to send data to the new index on the indexers.

View solution in original post

0 Karma

woodcock
Esteemed Legend

There is no such thing as a Master Indexer. You should have a created an app inside of master-apps on the Cluster Master that contains an indexes.conf file. DO NOT create any splunk configuration files for this directly on any indexers. Then push out the indexes.conf app (which has the file) using the cluster commands on the Cluster Master. This will cause a rolling restart on the Indexers once they receive the new configurations, after which you will be able to send data to the new index on the indexers.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We may have a terminology problem. There is no such thing as a "master indexer". The instance in charge of an indexer cluster is the "Master Node" or "Cluster Master". A clustered indexer cannot serve as the Master.
Defining an index on the Master Node (MN) and pushing the configuration to the peers will define that index on all indexers.
All of your Splunk instances should be forwarding their output to the indexers. Not only does that make all Splunk logs searchable, but it also means data added on the MN or a Search Head will be sent to the indexers and replicated properly.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

p_gurav
Champion

Could you share the indexes.conf? Also, on which Splunk instance wrote your inputs.conf?

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on