Monitoring Splunk

Can you help me figure out why my _audit and _internal index show status blank on mater-note?

SoknySplunk
Loves-to-Learn Lots

Hello Splunk Community,

Do all you guys know why my _audit and _internal index show status blank on Mater-note?

0 Karma
1 Solution

adonio
Ultra Champion

this is probably because you dont have repFactor set on these indexes ....
when you push configurations, here indexes.conf to your peers, you will have to add that attribute, either for the [default] stanza (so it will apply to all indexes) or under each index stanza [my_index]
my assumption is that you have pushed your index configuration by the Master-Node (e.g. Cluster Master) but the _internal and _audit indexes still use the pre-built per indexer configuration
read here for more detail: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Indexesconf
look for repFactor

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

this is probably because you dont have repFactor set on these indexes ....
when you push configurations, here indexes.conf to your peers, you will have to add that attribute, either for the [default] stanza (so it will apply to all indexes) or under each index stanza [my_index]
my assumption is that you have pushed your index configuration by the Master-Node (e.g. Cluster Master) but the _internal and _audit indexes still use the pre-built per indexer configuration
read here for more detail: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Indexesconf
look for repFactor

hope it helps

0 Karma

MoniM
Communicator

hi @SoknySplunk ,
can you run this btool command, you will get some information about the indexers:-
splunk cmd btool indexes list --debug

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...