Deployment Architecture

New index not showing in admin console

Sageth
New Member

I created a bunch of new, custom indexes (i.e. index=myApp) that go to a new path and restarted the indexers. The paths were created without any problem and all seems to be well.

I then added index=myApp on the forwarders and recycled splunkd and splunkweb services, but it still seems to be going to main instead of my new index.

A few things that I've noticed:

  • In admin, I don't see the new index to assign to the "Indexes searched by default"
  • In Settings -> Data -> Indexes, I don't see the new index there either. I could try to create it, but I don't want to cause other problems along the way.

Any thoughts?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

All indexes have to be created on Indexer. If you want to access the Indexes created on Indexer from Forwarder (or Search Head) UI, then you would have to create indexes with similar name on Forwarder(or Search Head). These indexes on Forwarders will not store data but they are required to be created to appear in dropdown on management views.

View solution in original post

somesoni2
Revered Legend

All indexes have to be created on Indexer. If you want to access the Indexes created on Indexer from Forwarder (or Search Head) UI, then you would have to create indexes with similar name on Forwarder(or Search Head). These indexes on Forwarders will not store data but they are required to be created to appear in dropdown on management views.

stath002
Path Finder

So just add your indexes.conf that goes on the indexers to the SH you are saying? Or does it have to be done via the UI?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

UI just edits the conf files. You might want to explore a way to have the same indexes.conf that is deployed to the indexers sent to the SHs so you keep a consistent list. Not required, but a good thing to consider.

0 Karma

stath002
Path Finder

OK cool thats what I thought I just wanted to double check 🙂

0 Karma

Sageth
New Member

Thanks, not having the path on the search head was the part I was missing. Didn't realize it had to be there, even if it wasn't used.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...