Where do I place indexes.conf in an indexer clustering environment?

[Federica_92]

Hi everyone,

I have the indexes.conf, but I'm not sure where to place it inside my cluster environment. I thought I had to place it on the master, inside the folder master-app, but this folder is reserved only for the app to duplicate for each instance.

So where can I place the file?

[rphillips_splk]

On your cluster master place your custom indexes.conf configurations in:
$SPLUNK_HOME/etc/master-apps/ _cluster/local/indexes.conf

then push the bundle to the peers.

http://docs.splunk.com/Documentation/Splunk/6.2.6/Indexer/Updatepeerconfigurations

[Federica_92]

It's exactly what I have done, but I can see only a couple of standard indexes..
And the indexes.conf has been correctly copied in the folder slave-apps..

[rphillips_splk]

Are you sure you are on the CLUSTER MASTER ? > INDEXER CLUSTERING >

[Federica_92]

yes, I checked now again, indexes(2) internal_, audit_..
Did I forget anything?
I created the file, put it in master-apps/_cluster/local, used the cli to bundle, and next I checked if in the indexer the file has been copied, and it was.

am I forgetting anything?

[shashi12345678]

im façing the same issue couldn't see the indexes.conf file that I have pushed from master node,

and I have tried ingesting data to that index, I got an error message, received the file on indexer-2 to index=test which is deleted/disabled.

How to resolve this issue please ?

[rphillips_splk]

have you sent any data to those indexes yet? if not, try that and they should show up there.

[Federica_92]

Once I did it, I can see in the slave-apps local/indexes.conf, but how can I display them from splunk gui? Clicking on indexer there isn't : (

[rphillips_splk]

From your cluster master GUI > settings >indexer clustering > then view the indexes tab