I prepared one lab with below instance to see real-time Single Site Index Clustering. But after configure I can only see _audit and _internal indexes from Cluster Master. Where are the rest of default indexes like main and etc?
1 Search Head with Deployment Server and License Master
1 Cluster Master
2 Indexer for Cluster Peer
I reviewed this question from https://answers.splunk.com/answers/143987/cluster-master-does-not-display-custom-or-main-index-only-... .
Note that, all the configuration is been done from CLI command not from apps.
Can anyone suggest me what can be a reason.
Also don't forget to set the setting per-index within the indexes.conf file of:
repFactor = auto
When you do introduce new indexes as per the documentation...
I tried today for additional index creation from master-app but it is not reflecting at cluster peer indexes. Although, configuration pushed and i can able to see at slave-apps. Any idea, what I am missing ?
which path you are refereeing ?
coldPath = $SPLUNK_DB/test/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test/db
maxTotalDataSizeMB = 500
coldToFrozenDir = /opt/frozen/test
thawedPath = $SPLUNK_DB/test/thaweddb
maxDataSize = 200
repFactor = auto
correct me if I'm wrong:
can you share a screenshot of Master Node Index Replication dashboard?
The index will not appear in the cluster master until it contains data as per Giuseppe previous post.
As per details from Giuseppe, indexes will not seen from Cluster-Master until data ingested on that index. But my question is, will that index can been seen from Cluster-Peers.
If the answer is simply NO, then it is fine for me. But if the answer is YES, then it is a problem for me.
Hope you can understand my question.
To confirm the index is configured on the peer you could run:
splunk btool indexes list --debug
(on the CLI of the peer)
Or look within the GUI of the individual indexer if that is turned on, does that help?
I didn't run /opt/splunk/bin/splunk btool indexes list --debug on cluster peer. But from GUI, I didn't see the index "test" on each cluster peer.
Which means, the configuration is wrong !
Interesting, I see 112 configured indexes on a peer and 88 of them are clustered/have data actively according to the master.
So it does sound like something may be incorrectly configured...
Can you confirm, in your configuration indexes.conf is located under master-apps/_cluster/local/ ?
Or you have put your indexes.conf under another app within master-app/your_app/local/ ?
Most of my index configuration is in the above location on the master.