Indexes in an Index Cluster

[dersa]

Hi, we have an Indexer Cluster with a dedicated Cluster Manager. The indexers have an additional hard drive attached for the custom indexes. The cluster manager has only one hard disk.

When adding an Index to the cluster manager's indexes.conf  I am getting this error "Failed to create directory". Does it mean the cluster manager must have the same number of  hard disks as the indexers or would it be sufficient, to create an Variable (CUSTOM_INDEX) pointing on the cluster manager to /opt/splunk-home/var/lib/splunk and on the indexers it point to a folder on the additional hard disk?

thanks in advanced for sharing your wisdom

Alex

[dersa]

Thanks Rick for your answer. I don't want to index anything on the CM. But I have to add the configuration on the CM in this file /opt/splunk/etc/manager-apps/_cluster/local/indexes.conf

I got an error message earlier, I think there were just some permissions missing. Everything looks good now. 

Thanks a lot for your quick feedback

Alex

[PickleRick]

OK. The $SPLUNK_HOME/etc/manager-apps directory contains only apps which are pushed to indexers. They are not applied locally. So your problem must have been (and was as you found yourself) caused by something else.

[PickleRick · Accepted solution]

You don't add indexes _to_ the CM. In fact CM should not be indexing anything locally. You want to forward all events from all your components to indexers. Indexers are the only components which should be doing local indexing. Other components should be only sending data "outwards" using outputs.conf and have local indexing disabled.