Deployment Architecture

Splunk shows cluster-status --verbose only shows 'main' index

kutzi
Path Finder

We have an indexer cluster with several custom indexes configured in the indexes.conf, however when we run:

 

splunk show cluster-status --verbose

 

only the main index shows up (among internal _ indexes).
What could be the reason for that?

When searching via the search heads, the indexes all work fine.

Labels (1)
0 Karma
1 Solution

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

View solution in original post

0 Karma

kutzi
Path Finder

The same applies to the Monitoring Console in the Web UI BTW

Tags (1)
0 Karma

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...