Deployment Architecture

Replicated Indexes Not Appearing In Cluster Dashboard

dcparker
Path Finder

Hey,

I have set up a clustered Splunk deployment in a lab environment to test. By default, I see _internal and _audit as my replicated indexes. The main index is not there for some reason. I have also added two new indexes in the indexes.conf in master-apps. I verified that this is being pushed to the slave-apps directory on the peers. I also verified that repFactor was set to auto. Any reason why this wouldn't be working or something I missed?

On the search head, when I search _internal, I get results from all 4 peers, so I know that is working.

Thanks for any help you can provide.

Tags (2)
1 Solution

mahamed_splunk
Splunk Employee
Splunk Employee

Can you make sure that the main index has some data? If the index is empty, then there is nothing to replicate and it won't show up in the dashboard as well.

View solution in original post

mahamed_splunk
Splunk Employee
Splunk Employee

Can you make sure that the main index has some data? If the index is empty, then there is nothing to replicate and it won't show up in the dashboard as well.

View solution in original post

dcparker
Path Finder

This was correct. I had a forwarding issue and it was not sending data to the proper index, so it did not appear in the clustering dashboard.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.