Indexes.conf question

[adalbor]

Hey All,
I have a question surrounding the best way to deploy the indexes.conf in our environment.

We currently have our indexes.conf deployed to our indexers, heavy forwarders, and ES. We deploy to our HF's as we have different data inputs on them and need the index information there for the config options to show in the GUI.

Today I setup a cold path that only the indexers have access to and deployed the new indexes.conf with that path specified to everything. Upon doing that the Splunk service complained about the path not existing on the HF's and wouldn't start back up during its initial check.

Whats the best way to ensure the HF's get the indexes.conf without running into the path issue? Once I configure the cold path for all of our indexes it will throw the same error message.

We manage all of this through server classes on our deployment server. The indexes.conf is in its own app that is assigned to server classes for the indexers, HF's and ES box.

Thanks,
Andrew

[traxxasbreaker · Accepted solution]

In many deployments, indexes.conf settings defining a volume would be placed in different apps for different parts of the infrastructure. These apps would use the same volume names as those used in your larger indexes.conf where all the indexes are defined, but they would use paths relevant to the parts of the infrastructure they get deployed to.

The volume app that the indexers get would be deployed only to them from the deployment server and would have the correct path definitions for the indexers. There would be a separate volume app for the deployment server to send to any other instances getting the indexes.conf configurations that would have the volumes defined using paths that would exist on those instances.

[adalbor]

So if we wanted to deploy to the HF's we would just use the default paths then?

[traxxasbreaker]

Yes, that would be the normal setup for anything that isn't an indexer.

[adalbor]

Thanks for your help!