Getting Data In

Index Master statistics different between Settings, Indexes and Setting, Index Clustering, Indexes

thormanrd
Path Finder

I have an index cluster with 24 indexers, and a set of custom indexes that I manage on the index master in $SPLUNK_HOME/etc/master-apps/_cluster/local. When I deploy the configuration bundle the indexes are configured on the indexers and reflected in Index Master Web UI just fine. However, the statistics between the Settings, Indexes and Setting, Index Clustering, Indexes web pages on the Index Master WebUI do not match. Bucket statistics seems reasonable on the Setting, Index Clustering, Indexes tab, but the Settings, Indexes pages continues to show 0 Events and no event dates for my custom indexes. Why?

0 Karma
1 Solution

thormanrd
Path Finder

Looks like the Settings, Indexes page has the statistics for the local file system(s) where indexed data is stored on that node. Since my index master is not an indexer, all the statistics are zero meaning there is no local bucket storage on that node. The Settings, Index Clustering, Indexes is the cluster wide metrics for all indexers cumulatively. I discovered this by browsing to all the indexers Settings, Indexes and found the metrics were different per node. All together they added up to Settings, Index Clustering, Indexes.

So, the Settings, Indexes is local. Settings, Index Clustering, Indexes is the sum of all index cluster members.

G2G

View solution in original post

0 Karma

thormanrd
Path Finder

Looks like the Settings, Indexes page has the statistics for the local file system(s) where indexed data is stored on that node. Since my index master is not an indexer, all the statistics are zero meaning there is no local bucket storage on that node. The Settings, Index Clustering, Indexes is the cluster wide metrics for all indexers cumulatively. I discovered this by browsing to all the indexers Settings, Indexes and found the metrics were different per node. All together they added up to Settings, Index Clustering, Indexes.

So, the Settings, Indexes is local. Settings, Index Clustering, Indexes is the sum of all index cluster members.

G2G

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...