Deployment Architecture

Splunk shows cluster-status --verbose only shows 'main' index

kutzi
Path Finder

We have an indexer cluster with several custom indexes configured in the indexes.conf, however when we run:

 

splunk show cluster-status --verbose

 

only the main index shows up (among internal _ indexes).
What could be the reason for that?

When searching via the search heads, the indexes all work fine.

Labels (1)
0 Karma
1 Solution

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

View solution in original post

0 Karma

kutzi
Path Finder

The same applies to the Monitoring Console in the Web UI BTW

Tags (1)
0 Karma

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...