indexes.conf in both /system/local and /slave_apps/_cluster/local in a cluster environment

[sathwikr076]

Hello,

We have few indexers which are in clustered environment but i see there is indexes.conf in both /system/local and /slave_apps/_cluster?local where the cluster master is pushing the configurations. But the log path in both the indexes.conf is same for all the indexes. So, is there any way to confirm the data is ingesting using one particular indexes.conf.

Thanks.

[richgalloway · Accepted solution]

Run the btool CLI command on one of the indexers.

splunk btool --debug indexes list | more

The output will show all indexes.conf settings and the file they came from.

[andyk1116]

Are you using a deployment server to push an app containing the indexes.conf to the cluster master? If not, how are the indexes.conf files being configured on the cluster master?

If you just want to see where the indexer is pulling the configuation from then use the below cmd on an indexer.

On the indexer you can run the below command and it will tell you where it's pulling the configuration from.

./splunk btool indexes list --debug