Deployment Architecture

Why is the cluster master of a multisite indexer cluster not showing new indexes I created and deployed to the peers?

jbresciani
New Member

I am setting up a multisite cluster with 2 indexers and 1 sh in each site, 2 sites (for now). I've created 2 extra indexes in $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf and successfully deployed them to the peers. When on the peers I can see the config in slave-apps and the new folders under $SPLUNK_db/, but on the cluster master at the end point /en-US/manager/system/clustering?tab=indexes, I only see the indexes _audit and _internal.

What did I miss?

I deployed by hand editing the indexes.conf file on the master and then hitting deploy from the web ui on the master.

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

Do you have any data in the newly created indexes ? Cluster master will track the indexes once it has the data. Forward some data to it then you will see it in the master dashboards.

0 Karma
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...