I prepared one lab with below instance to see real-time Single Site Index Clustering. But after configure I can only see _audit and _internal indexes from Cluster Master. Where are the rest of default indexes like main and etc?
1 Search Head with Deployment Server and License Master
1 Cluster Master
2 Indexer for Cluster Peer
I reviewed this question from https://answers.splunk.com/answers/143987/cluster-master-does-not-display-custom-or-main-index-only-... .
Note that, all the configuration is been done from CLI command not from apps.
Can anyone suggest me what can be a reason.
I tried today for additional index creation from master-app but it is not reflecting at cluster peer indexes. Although, configuration pushed and i can able to see at slave-apps. Any idea, what I am missing ?
which path you are refereeing ?
coldPath = $SPLUNK_DB/test/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test/db
maxTotalDataSizeMB = 500
coldToFrozenDir = /opt/frozen/test
thawedPath = $SPLUNK_DB/test/thaweddb
maxDataSize = 200
repFactor = auto
correct me if I'm wrong:
can you share a screenshot of Master Node Index Replication dashboard?
As per details from Giuseppe, indexes will not seen from Cluster-Master until data ingested on that index. But my question is, will that index can been seen from Cluster-Peers.
If the answer is simply NO, then it is fine for me. But if the answer is YES, then it is a problem for me.
Hope you can understand my question.
To confirm the index is configured on the peer you could run:
splunk btool indexes list --debug
(on the CLI of the peer)
Or look within the GUI of the individual indexer if that is turned on, does that help?
I didn't run /opt/splunk/bin/splunk btool indexes list --debug on cluster peer. But from GUI, I didn't see the index "test" on each cluster peer.
Which means, the configuration is wrong !
Interesting, I see 112 configured indexes on a peer and 88 of them are clustered/have data actively according to the master.
So it does sound like something may be incorrectly configured...
Can you confirm, in your configuration indexes.conf is located under master-apps/_cluster/local/ ?
Or you have put your indexes.conf under another app within master-app/your_app/local/ ?