Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: index-cluster
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index-cluster
We have two indexer, When I created new index on Master Node and pushed them into 2 indexer, Only one Indexer can received configuaration changes from Master Node and the others can't received
All the connection between Indexer 1,2 and Master Node are working correctly, include releated ports
related port
related portss
!please help me to resolve it
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi!!
Can you check your monitoring console to find your indexer clustering status and "Indexer Clustering:Service Activity" for any warning or error over the time? Also, make sure you get your indexers listed in the peers in the indexer clustering.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On your master node, please try $SPLUNK_HOME/bin/splunk show cluster-bundle-status. In the output, are all of the indexers you're expecting showing that they are connected to the cluster master, and do they all show that they have the same bundle?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi vumanhtai,
Could you please check master_uri configuration in server.conf file of the indexer which is not receiving configurations. The file will be at $SPLUNK_HOME/etc/system/local directory.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
If i have only two indexers then how can i create rwplication without being having third index instance as cluster master.
Can i make any one as claster master as i have only two indexers ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
