Deployment Architecture

Splunk shows cluster-status --verbose only shows 'main' index

kutzi
Path Finder

We have an indexer cluster with several custom indexes configured in the indexes.conf, however when we run:

 

splunk show cluster-status --verbose

 

only the main index shows up (among internal _ indexes).
What could be the reason for that?

When searching via the search heads, the indexes all work fine.

Labels (1)
0 Karma
1 Solution

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

View solution in original post

0 Karma

kutzi
Path Finder

The same applies to the Monitoring Console in the Web UI BTW

Tags (1)
0 Karma

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...