Getting Data In

Indexes.conf question

adalbor
Builder

Hey All,
I have a question surrounding the best way to deploy the indexes.conf in our environment.

We currently have our indexes.conf deployed to our indexers, heavy forwarders, and ES. We deploy to our HF's as we have different data inputs on them and need the index information there for the config options to show in the GUI.

Today I setup a cold path that only the indexers have access to and deployed the new indexes.conf with that path specified to everything. Upon doing that the Splunk service complained about the path not existing on the HF's and wouldn't start back up during its initial check.

Whats the best way to ensure the HF's get the indexes.conf without running into the path issue? Once I configure the cold path for all of our indexes it will throw the same error message.

We manage all of this through server classes on our deployment server. The indexes.conf is in its own app that is assigned to server classes for the indexers, HF's and ES box.

Thanks,
Andrew

1 Solution

traxxasbreaker
Communicator

In many deployments, indexes.conf settings defining a volume would be placed in different apps for different parts of the infrastructure. These apps would use the same volume names as those used in your larger indexes.conf where all the indexes are defined, but they would use paths relevant to the parts of the infrastructure they get deployed to.

The volume app that the indexers get would be deployed only to them from the deployment server and would have the correct path definitions for the indexers. There would be a separate volume app for the deployment server to send to any other instances getting the indexes.conf configurations that would have the volumes defined using paths that would exist on those instances.

View solution in original post

0 Karma

traxxasbreaker
Communicator

In many deployments, indexes.conf settings defining a volume would be placed in different apps for different parts of the infrastructure. These apps would use the same volume names as those used in your larger indexes.conf where all the indexes are defined, but they would use paths relevant to the parts of the infrastructure they get deployed to.

The volume app that the indexers get would be deployed only to them from the deployment server and would have the correct path definitions for the indexers. There would be a separate volume app for the deployment server to send to any other instances getting the indexes.conf configurations that would have the volumes defined using paths that would exist on those instances.

0 Karma

adalbor
Builder

So if we wanted to deploy to the HF's we would just use the default paths then?

0 Karma

traxxasbreaker
Communicator

Yes, that would be the normal setup for anything that isn't an indexer.

0 Karma

adalbor
Builder

Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...