Getting Data In

indexes.conf in both /system/local and /slave_apps/_cluster/local in a cluster environment

sathwikr076
Communicator

Hello,

We have few indexers which are in clustered environment but i see there is indexes.conf in both /system/local and /slave_apps/_cluster?local where the cluster master is pushing the configurations. But the log path in both the indexes.conf is same for all the indexes. So, is there any way to confirm the data is ingesting using one particular indexes.conf.

Thanks.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Run the btool CLI command on one of the indexers.

splunk btool --debug indexes list | more

The output will show all indexes.conf settings and the file they came from.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Run the btool CLI command on one of the indexers.

splunk btool --debug indexes list | more

The output will show all indexes.conf settings and the file they came from.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

andyk1116
New Member

Are you using a deployment server to push an app containing the indexes.conf to the cluster master? If not, how are the indexes.conf files being configured on the cluster master?

If you just want to see where the indexer is pulling the configuation from then use the below cmd on an indexer.

On the indexer you can run the below command and it will tell you where it's pulling the configuration from.

./splunk btool indexes list --debug

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!