Deployment Architecture

indexer replication

dkr3500
Path Finder

I stood up a new set of indexers this weekend and set my RF=2 and SF=1 on the CM with the hope that the old indexers will replicate the data and populate the new set of indexers (I'm going to eventually decom the old indexers).

However, that doesn't seem to be working.  All the peers are up and running, and UFs are sending data correctly via indexer_discovery...but the data isn't being replicated.  My question is, why aren't my indexes (other than these native ones) showing up here on the CM? (Settings > Indexer clustering > Indexes tab:

Only native indexes are showing up on cluster master.Only native indexes are showing up on cluster master.

Labels (1)
0 Karma
1 Solution

dkr3500
Path Finder

@s2_splunk thanks for following-up on this post.

Splunk doc: https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/Migratenon-clusteredindexerstoaclusterede...

I needed to add:

repFactor = auto

under each [index_name] stanza on my cluster master's indexes.conf that gets pushed out to the peer nodes (indexers).

Once I updated indexes.conf, and applied the latest bundle on the CM (/opt/splunk/bin/splunk apply cluster-bundle --answer-yes), it started to replicated the custom indexes.

Important note: don't updated all indexes and push out the new cluster bundle at once, it its too much for the CM...update one index at a time and apply the cluster bundle.

View solution in original post

0 Karma

dkr3500
Path Finder

@s2_splunk thanks for following-up on this post.

Splunk doc: https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/Migratenon-clusteredindexerstoaclusterede...

I needed to add:

repFactor = auto

under each [index_name] stanza on my cluster master's indexes.conf that gets pushed out to the peer nodes (indexers).

Once I updated indexes.conf, and applied the latest bundle on the CM (/opt/splunk/bin/splunk apply cluster-bundle --answer-yes), it started to replicated the custom indexes.

Important note: don't updated all indexes and push out the new cluster bundle at once, it its too much for the CM...update one index at a time and apply the cluster bundle.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

What did your deployment look like before, was it already a cluster, albeit a smaller one?

If you did not have a cluster before, your existing data will sit in standalone buckets and will not replicate by default. Also, when using clustering, all peer definitions (indexes.conf) is done on the CM (master-apps) and bundle-pushed to the peers.  This is how the CM knows about indexes in the cluster.

Need to understand a bit better where you started from to be able to help.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...