Deployment Architecture

Splunk shows cluster-status --verbose only shows 'main' index

kutzi
Path Finder

We have an indexer cluster with several custom indexes configured in the indexes.conf, however when we run:

 

splunk show cluster-status --verbose

 

only the main index shows up (among internal _ indexes).
What could be the reason for that?

When searching via the search heads, the indexes all work fine.

Labels (1)
0 Karma
1 Solution

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

View solution in original post

0 Karma

kutzi
Path Finder

The same applies to the Monitoring Console in the Web UI BTW

Tags (1)
0 Karma

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...