Getting Data In

indexes.conf in both /system/local and /slave_apps/_cluster/local in a cluster environment

sathwikr076
Communicator

Hello,

We have few indexers which are in clustered environment but i see there is indexes.conf in both /system/local and /slave_apps/_cluster?local where the cluster master is pushing the configurations. But the log path in both the indexes.conf is same for all the indexes. So, is there any way to confirm the data is ingesting using one particular indexes.conf.

Thanks.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Run the btool CLI command on one of the indexers.

splunk btool --debug indexes list | more

The output will show all indexes.conf settings and the file they came from.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Run the btool CLI command on one of the indexers.

splunk btool --debug indexes list | more

The output will show all indexes.conf settings and the file they came from.

---
If this reply helps you, Karma would be appreciated.

andyk1116
New Member

Are you using a deployment server to push an app containing the indexes.conf to the cluster master? If not, how are the indexes.conf files being configured on the cluster master?

If you just want to see where the indexer is pulling the configuation from then use the below cmd on an indexer.

On the indexer you can run the below command and it will tell you where it's pulling the configuration from.

./splunk btool indexes list --debug

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...