Deployment Architecture

Replicated Indexes Not Appearing In Cluster Dashboard

dcparker
Path Finder

Hey,

I have set up a clustered Splunk deployment in a lab environment to test. By default, I see _internal and _audit as my replicated indexes. The main index is not there for some reason. I have also added two new indexes in the indexes.conf in master-apps. I verified that this is being pushed to the slave-apps directory on the peers. I also verified that repFactor was set to auto. Any reason why this wouldn't be working or something I missed?

On the search head, when I search _internal, I get results from all 4 peers, so I know that is working.

Thanks for any help you can provide.

Tags (2)
1 Solution

mahamed_splunk
Splunk Employee
Splunk Employee

Can you make sure that the main index has some data? If the index is empty, then there is nothing to replicate and it won't show up in the dashboard as well.

View solution in original post

mahamed_splunk
Splunk Employee
Splunk Employee

Can you make sure that the main index has some data? If the index is empty, then there is nothing to replicate and it won't show up in the dashboard as well.

dcparker
Path Finder

This was correct. I had a forwarding issue and it was not sending data to the proper index, so it did not appear in the clustering dashboard.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...