I'm putting together a large environment, so I'm hoping to get this sorted out before I dig myself into a hole.
I have multiple indexers (4 currently, more in the future), two search heads, and many forwarders.
One of those indexers functions as a deployment server.
The forwarders are all configured for auto load balancing between the four indexers (the list is maintained via DNS. Several A records with the same name and multiple IPs.)
As we bring in new application logs into the environment (and it is happening quite rapidly), I'm finding it isn't that simple to keep the props.conf, transforms.conf, etc all properly sycned up between the indexers. Same goes for indexes.conf.
What is the best/preferred way to maintain a uniform configuration between multiple indexers?
Also, I know that index-time field extractions must be on the indexers. That's obvious. For search-time extractions however - do those have to be on the search heads, or will the indexers report those fields back up to the search head while they perform the search?
I have a few thoughts/ideas. Not sure if they are good ones though.
Any better plans?
Coming back to this old question:
We've since upgraded all of our indexers to Splunk 5, and have set up a clustered search environment. Since clustering requires all of the indexers to have all of their props/transforms/idnexes.conf in sync, the use of the cluster master solved this problem for us.
Coming back to this old question:
We've since upgraded all of our indexers to Splunk 5, and have set up a clustered search environment. Since clustering requires all of the indexers to have all of their props/transforms/idnexes.conf in sync, the use of the cluster master solved this problem for us.