Deployment Architecture

What's the proper way to add an indexer to an indexer cluster?

ddrillic
Ultra Champion

We are about to add an indexer to an index cluster version 6.5.2. How do we it including the DMC part?

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Does your existing indexer have data on it? Is it a new indexer your adding to the cluster?

You need to add this new indexer as a search peer to the search head, master node and the DMC. When adding to the DMC, you should classify this as an indexer and not a search head

Lastly, you will need to modify outputs.conf on your forwarders to add this additional indexer (search peer). The best approach is to create an outputs app on the deployment server, this way you can edit your outputs.conf in one spot and send it to all of your hosts.

http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Configurethepeerindexes

View solution in original post

traxxasbreaker
Communicator

You will need to setup a clustering stanza in the indexer's server.conf file to use the same pass4SymmKey to use the same value as the cluster master. Note that these values are hashed, and if $SPLUNK_HOME/etc/auth/splunk.secret does not match with your cluster master, you will need to put the plain text value in on your indexer and let Splunk hash it when it starts up.

Additionally, you'll need to set the master_uri setting in your clustering stanza to point to the cluster master and make sure it's set to be a slave. Details on the indexer configuration can be found here. If your environment was first built by professional services, look around in the etc/apps directory on your indexers for an app that's called something like <org>_indexer_base which should have a lot of these settings already in place.

You'll also need to set your indexers to point to the license master (also in server.conf) and to share all the inputs and index time settings of your other indexers. In many environments this is handled by apps pushed from the cluster master. If the indexers are Linux, also pay close attention to ulimits and THP at the time you are building your indexers.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Does your existing indexer have data on it? Is it a new indexer your adding to the cluster?

You need to add this new indexer as a search peer to the search head, master node and the DMC. When adding to the DMC, you should classify this as an indexer and not a search head

Lastly, you will need to modify outputs.conf on your forwarders to add this additional indexer (search peer). The best approach is to create an outputs app on the deployment server, this way you can edit your outputs.conf in one spot and send it to all of your hosts.

http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Configurethepeerindexes

ddrillic
Ultra Champion

-- Does your existing indexer have data on it? Is it a new indexer your adding to the cluster?
No data yet - it's a new indexer...

Perfect @skoelpin. Let me go please through the documentation.

0 Karma

traxxasbreaker
Communicator

Is the question how to add it to the actual indexer cluster by connecting it to the cluster master, or how to make it show up as part of the indexer cluster on the DMC after it's already been added to the cluster?

0 Karma

ddrillic
Ultra Champion

-- Is the question how to add it to the actual indexer cluster by connecting it to the cluster master,..
Right - that's it.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...