- Splunk Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Can you help me figure out why my _audit and _inte...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Splunk Community,
Do all you guys know why my _audit and _internal index show status blank on Mater-note?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is probably because you dont have repFactor set on these indexes ....
when you push configurations, here indexes.conf to your peers, you will have to add that attribute, either for the [default] stanza (so it will apply to all indexes) or under each index stanza [my_index]
my assumption is that you have pushed your index configuration by the Master-Node (e.g. Cluster Master) but the _internal and _audit indexes still use the pre-built per indexer configuration
read here for more detail: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Indexesconf
look for repFactor
hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is probably because you dont have repFactor set on these indexes ....
when you push configurations, here indexes.conf to your peers, you will have to add that attribute, either for the [default] stanza (so it will apply to all indexes) or under each index stanza [my_index]
my assumption is that you have pushed your index configuration by the Master-Node (e.g. Cluster Master) but the _internal and _audit indexes still use the pre-built per indexer configuration
read here for more detail: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Indexesconf
look for repFactor
hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @SoknySplunk ,
can you run this btool command, you will get some information about the indexers:-
splunk cmd btool indexes list --debug
Thanks
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
