Getting Data In

How to Not apply cluster-bundle

Ed_Alias
Path Finder

Hi,

i am installing two new indexers for test, as test indexers they have very small disks.

As clustermember they get indexes.conf from the cluster-bundle, where _internal is set to keep logs for a year.

_internal configuration is made for my production splunk servers, how can i bypass the cluster bundle on the tests servers ?

Regards,
Edouard Alias

0 Karma

Ed_Alias
Path Finder

Hi,

believed slave apps is prioritary to system/local folder..

i thinks i'll have to let them out of cluster and use my master only as licence server ?

0 Karma

muebel
SplunkTrust
SplunkTrust

good point, I updated the answer to clarify how this could work.

Yeah, you can still point the indexers to the master as your license server.

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi Ed_alias, If your cluster apps are defining indexes in default only, I believe that you could put config into $SPLUNKHOME/etc/system/local/indexes.conf to override anything the cluster master puts out, but you'll want to be very careful about this. See : http://docs.splunk.com/Documentation/Splunk/6.1/admin/Wheretofindtheconfigurationfiles for more info on config precedence.

Alternatively, you could not add the indexers to the cluster, and leave them as independent indexers.

Let me know if this helps! 😄

0 Karma

Ed_Alias
Path Finder

i just need a differant config for _internal index on the two indexing tests servers...

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...