Deployment Architecture
Highlighted

Where do I place indexes.conf in an indexer clustering environment?

Communicator

Hi everyone,

I have the indexes.conf, but I'm not sure where to place it inside my cluster environment. I thought I had to place it on the master, inside the folder master-app, but this folder is reserved only for the app to duplicate for each instance.

So where can I place the file?

Labels (1)
0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Splunk Employee
Splunk Employee

On your cluster master place your custom indexes.conf configurations in:
$SPLUNK_HOME/etc/master-apps/ _cluster/local/indexes.conf

then push the bundle to the peers.

http://docs.splunk.com/Documentation/Splunk/6.2.6/Indexer/Updatepeerconfigurations

Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Communicator

Once I did it, I can see in the slave-apps local/indexes.conf, but how can I display them from splunk gui? Clicking on indexer there isn't : (

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Splunk Employee
Splunk Employee

From your cluster master GUI > settings >indexer clustering > then view the indexes tab

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Communicator

It's exactly what I have done, but I can see only a couple of standard indexes..
And the indexes.conf has been correctly copied in the folder slave-apps..

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Splunk Employee
Splunk Employee

Are you sure you are on the CLUSTER MASTER ? > INDEXER CLUSTERING >

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Communicator

yes, I checked now again, indexes(2) internal, audit..
Did I forget anything?
I created the file, put it in master-apps/_cluster/local, used the cli to bundle, and next I checked if in the indexer the file has been copied, and it was.

am I forgetting anything?

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Splunk Employee
Splunk Employee

have you sent any data to those indexes yet? if not, try that and they should show up there.

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

im façing the same issue couldn't see the indexes.conf file that I have pushed from master node,

and I have tried ingesting data to that index, I got an error message, received the file on indexer-2 to index=test which is deleted/disabled.

How to resolve this issue please ?

0 Karma