Creating index centrally

[echalex]

Hi,

Is there any way of creating indexes on several indexers centrally? For a fairly small indexer-farm, it isn't much hassle to do it manually, but for several servers, it might be easier and more resistant to human error to do it centrally.

[BobM · Accepted solution]

I would recommend you look at deployment server. You can set one server to be master. Put the indexes.conf into an app called "indexer" set it to deploy the app whenever you add new indexes.

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutdeploymentserver

[echalex]

Thanks! I do have a deployment set up, so that seems like a plausible solution. I thought about this, but I haven't found any mention of it, so I wanted to ask first.