Getting Data In

How to stop the master node from indexing data ?

ameslet
Explorer

Hi,

I have an indexer cluster composed of 2 indexers with a master node. I have seen that my master node is actually indexing data as well as both indexers. As I don't have a lot of disk space free on my master node, I don't want it to index data. How can I prevent him from doing that ?

Alex

0 Karma

somesoni2
Revered Legend

THis link should give you all the configuration changes required to Forwarder all data from Master node to Indexer layer (no indexing at master node)

http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Forwardmasterdata

0 Karma

hardik_splunk
Splunk Employee
Splunk Employee

You need to have outputs.conf file on your Indexer Master. In that file, turn off indexing and configure it to forward to your indexers. In other words, outputs.conf should be similar to the one you have on your forwarders.

Following is a sample configuration:

[indexAndForward]
index = false

[tcpout]
defaultGroup =clustered_indexers
forwardedindex.filter.disable = true
indexAndForward = false

[tcpout:clustered_indexers]
autoLB = true
compressed = true
server = 10.37.20.38:9997,10.37.20.28:9997

0 Karma

renjith_nair
Legend

Hi @ameslet

Just turn off indexing in outputs.conf

[indexAndForward]
index = [true|false]
* If set to true, data is indexed.
* If set to false, data is not indexed.
* Default depends on whether the Splunk instance is configured as a
  forwarder, modified by any value configured for the indexAndForward
  attribute in [tcpout].

And obviously, add the configurations to forward the data to indexers

---
What goes around comes around. If it helps, hit it with Karma 🙂

wshaari
Engager

do you have apps that might be setting it at the app context

find $SPLUNK_HOME/etc/ -name outputs.conf|xargs grep --color index

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Check using Btool to see if this is applied in any other configuration files

./splunk btool outputs list --debug

This is Splunk's internal configuration validation tool. The debug option will show you which file the configuration is applied in.

ameslet
Explorer

Hi,
Thanks a lot for your answer. I have checked the configuration files but I don't have any outputs.conf in my local directory and the value is already set up to false on the same file in the default directory. However, I can say that it is still indexing data as I have checked the time of warm buckets.
Do you have another idea how could I do it ?

0 Karma

renjith_nair
Legend

Please have a look at forwardmasterdata

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...