I have a number of indexes that only exist on the indexers. In the past, I know that I have been able to select them in the role management GUI and now they do not appear. The
authorize.conf on the Search Head Cluster has them listed under the roles.
[role_user] srchDiskQuota = 250 srchIndexesAllowed = application;idx_appdev;idx_citrix;idx_fourd;idx_infrastructure;main;network;os;perfmon;server;wind srchIndexesDefault = application;idx_appdev;main;perfmon;server;windows;wineventlog;winevents srchMaxTime = 8640000
However I do not see these in the GUI. Any ideas? Do I now have to make a placeholder indexes with these names on the SHC for them to show up? Seems sloppy.
" Do I now have to make a placeholder indexes with these names on the SHC for them to show up? "
Just place a copy of you indexes.conf from the indexers in your SHC
Hi @teunlaan, not sure about that -
-- Just place a copy of you indexes.conf from the indexers in your SHC
Looking at a functioning cluster at one SH and I see -
cd /opt/splunk/etc $ find . -name indexes.conf ./system/local/indexes.conf ./system/default/indexes.conf ./master-apps/_cluster/default/indexes.conf ./apps/<app name1>/default/indexes.conf ./apps/<app name2>/default/indexes.conf
indexes.conf is nowhere to be found.
Following @teunlaan advice I placed a dumbed-down copy of my indexes.conf on the search head members. This appears to have worked. Limiting sizes, bare minimum to run.
[perfmon] coldPath = $SPLUNK_DB/perfmon/colddb homePath = $SPLUNK_DB/perfmon/db maxTotalDataSizeMB = 1000 thawedPath = $SPLUNK_DB/perfmon/thaweddb [security] coldPath = $SPLUNK_DB/security/colddb homePath = $SPLUNK_DB/security/db maxTotalDataSizeMB = 1000 thawedPath = $SPLUNK_DB/security/thaweddb