Hi everyone,
I have the indexes.conf, but I'm not sure where to place it inside my cluster environment. I thought I had to place it on the master, inside the folder master-app, but this folder is reserved only for the app to duplicate for each instance.
So where can I place the file?
On your cluster master place your custom indexes.conf configurations in:
$SPLUNK_HOME/etc/master-apps/ _cluster/local/indexes.conf
then push the bundle to the peers.
http://docs.splunk.com/Documentation/Splunk/6.2.6/Indexer/Updatepeerconfigurations
It's exactly what I have done, but I can see only a couple of standard indexes..
And the indexes.conf has been correctly copied in the folder slave-apps..
Are you sure you are on the CLUSTER MASTER ? > INDEXER CLUSTERING >
yes, I checked now again, indexes(2) internal_, audit_..
Did I forget anything?
I created the file, put it in master-apps/_cluster/local, used the cli to bundle, and next I checked if in the indexer the file has been copied, and it was.
am I forgetting anything?
im façing the same issue couldn't see the indexes.conf file that I have pushed from master node,
and I have tried ingesting data to that index, I got an error message, received the file on indexer-2 to index=test which is deleted/disabled.
How to resolve this issue please ?
have you sent any data to those indexes yet? if not, try that and they should show up there.
Once I did it, I can see in the slave-apps local/indexes.conf, but how can I display them from splunk gui? Clicking on indexer there isn't : (
From your cluster master GUI > settings >indexer clustering > then view the indexes tab