Can you help me figure out why my _audit and _internal index show status blank on mater-note?

[SoknySplunk]

Hello Splunk Community,

Do all you guys know why my _audit and _internal index show status blank on Mater-note?

[adonio · Accepted solution]

this is probably because you dont have repFactor set on these indexes ....
when you push configurations, here indexes.conf to your peers, you will have to add that attribute, either for the [default] stanza (so it will apply to all indexes) or under each index stanza [my_index]
my assumption is that you have pushed your index configuration by the Master-Node (e.g. Cluster Master) but the _internal and _audit indexes still use the pre-built per indexer configuration
read here for more detail: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Indexesconf
look for repFactor

hope it helps

[MoniM]

hi @SoknySplunk ,
can you run this btool command, you will get some information about the indexers:-
splunk cmd btool indexes list --debug

Thanks