I have the indexes.conf, but I'm not sure where to place it inside my cluster environment. I thought I had to place it on the master, inside the folder master-app, but this folder is reserved only for the app to duplicate for each instance.
So where can I place the file?
On your cluster master place your custom indexes.conf configurations in:
then push the bundle to the peers.
Once I did it, I can see in the slave-apps local/indexes.conf, but how can I display them from splunk gui? Clicking on indexer there isn't : (
It's exactly what I have done, but I can see only a couple of standard indexes..
And the indexes.conf has been correctly copied in the folder slave-apps..
yes, I checked now again, indexes(2) internal, audit..
Did I forget anything?
I created the file, put it in master-apps/_cluster/local, used the cli to bundle, and next I checked if in the indexer the file has been copied, and it was.
am I forgetting anything?
im façing the same issue couldn't see the indexes.conf file that I have pushed from master node,
and I have tried ingesting data to that index, I got an error message, received the file on indexer-2 to index=test which is deleted/disabled.
How to resolve this issue please ?