Replicated Indexes Not Appearing In Cluster Dashboard

[dcparker]

Hey,

I have set up a clustered Splunk deployment in a lab environment to test. By default, I see _internal and _audit as my replicated indexes. The main index is not there for some reason. I have also added two new indexes in the indexes.conf in master-apps. I verified that this is being pushed to the slave-apps directory on the peers. I also verified that repFactor was set to auto. Any reason why this wouldn't be working or something I missed?

On the search head, when I search _internal, I get results from all 4 peers, so I know that is working.

Thanks for any help you can provide.

[mahamed_splunk · Accepted solution]

Can you make sure that the main index has some data? If the index is empty, then there is nothing to replicate and it won't show up in the dashboard as well.

[dcparker]

This was correct. I had a forwarding issue and it was not sending data to the proper index, so it did not appear in the clustering dashboard.