Index Master statistics different between Settings, Indexes and Setting, Index Clustering, Indexes

[thormanrd]

I have an index cluster with 24 indexers, and a set of custom indexes that I manage on the index master in $SPLUNK_HOME/etc/master-apps/_cluster/local. When I deploy the configuration bundle the indexes are configured on the indexers and reflected in Index Master Web UI just fine. However, the statistics between the Settings, Indexes and Setting, Index Clustering, Indexes web pages on the Index Master WebUI do not match. Bucket statistics seems reasonable on the Setting, Index Clustering, Indexes tab, but the Settings, Indexes pages continues to show 0 Events and no event dates for my custom indexes. Why?

[thormanrd · Accepted solution]

Looks like the Settings, Indexes page has the statistics for the local file system(s) where indexed data is stored on that node. Since my index master is not an indexer, all the statistics are zero meaning there is no local bucket storage on that node. The Settings, Index Clustering, Indexes is the cluster wide metrics for all indexers cumulatively. I discovered this by browsing to all the indexers Settings, Indexes and found the metrics were different per node. All together they added up to Settings, Index Clustering, Indexes.

So, the Settings, Indexes is local. Settings, Index Clustering, Indexes is the sum of all index cluster members.

G2G