Deployment Architecture
Highlighted

Where do I place indexes.conf in an indexer clustering environment?

Communicator

Hi everyone,

I have the indexes.conf, but I'm not sure where to place it inside my cluster environment. I thought I had to place it on the master, inside the folder master-app, but this folder is reserved only for the app to duplicate for each instance.

So where can I place the file?

Labels (1)
0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

On your cluster master place your custom indexes.conf configurations in:
$SPLUNK_HOME/etc/master-apps/ _cluster/local/indexes.conf

then push the bundle to the peers.

http://docs.splunk.com/Documentation/Splunk/6.2.6/Indexer/Updatepeerconfigurations

Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Communicator

Once I did it, I can see in the slave-apps local/indexes.conf, but how can I display them from splunk gui? Clicking on indexer there isn't : (

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

From your cluster master GUI > settings >indexer clustering > then view the indexes tab

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Communicator

It's exactly what I have done, but I can see only a couple of standard indexes..
And the indexes.conf has been correctly copied in the folder slave-apps..

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Are you sure you are on the CLUSTER MASTER ? > INDEXER CLUSTERING >

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

Communicator

yes, I checked now again, indexes(2) internal, audit..
Did I forget anything?
I created the file, put it in master-apps/_cluster/local, used the cli to bundle, and next I checked if in the indexer the file has been copied, and it was.

am I forgetting anything?

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

have you sent any data to those indexes yet? if not, try that and they should show up there.

0 Karma
Highlighted

Re: Where do I place indexes.conf in an indexer clustering environment?

im façing the same issue couldn't see the indexes.conf file that I have pushed from master node,

and I have tried ingesting data to that index, I got an error message, received the file on indexer-2 to index=test which is deleted/disabled.

How to resolve this issue please ?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.