Deployment Architecture

Where do I place indexes.conf in an indexer clustering environment?

Federica_92
Communicator

Hi everyone,

I have the indexes.conf, but I'm not sure where to place it inside my cluster environment. I thought I had to place it on the master, inside the folder master-app, but this folder is reserved only for the app to duplicate for each instance.

So where can I place the file?

Labels (1)
0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

On your cluster master place your custom indexes.conf configurations in:
$SPLUNK_HOME/etc/master-apps/ _cluster/local/indexes.conf

then push the bundle to the peers.

http://docs.splunk.com/Documentation/Splunk/6.2.6/Indexer/Updatepeerconfigurations

Federica_92
Communicator

It's exactly what I have done, but I can see only a couple of standard indexes..
And the indexes.conf has been correctly copied in the folder slave-apps..

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

Are you sure you are on the CLUSTER MASTER ? > INDEXER CLUSTERING >

0 Karma

Federica_92
Communicator

yes, I checked now again, indexes(2) internal_, audit_..
Did I forget anything?
I created the file, put it in master-apps/_cluster/local, used the cli to bundle, and next I checked if in the indexer the file has been copied, and it was.

am I forgetting anything?

0 Karma

shashi12345678
Engager

im façing the same issue couldn't see the indexes.conf file that I have pushed from master node,

and I have tried ingesting data to that index, I got an error message, received the file on indexer-2 to index=test which is deleted/disabled.

How to resolve this issue please ?

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

have you sent any data to those indexes yet? if not, try that and they should show up there.

0 Karma

Federica_92
Communicator

Once I did it, I can see in the slave-apps local/indexes.conf, but how can I display them from splunk gui? Clicking on indexer there isn't : (

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

From your cluster master GUI > settings >indexer clustering > then view the indexes tab

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...