Install ES on an Indexers Cluster

[gcusello]

Hi at all,
probably it's a stupid question, but I don't know very well if ES has special requirements for Indexers Clusters and documentation doesn't help me.
I took in charge a Splunk installation where I found an Indexers Cluster where is installed the Splunk_TA_ForIndexers containing the indexes.conf file for ES correctly deployed using Master Node.
The problem is that in indexes.conf there isn't the clause repFactor = auto in indexes stanzas, so indexes aren't replicated between the cluster!
I know that old events aren't replicated between Indexers, so what it will happen if I insert the clause in indexes.conf?

Thank you for your help.

Bye.
Giuseppe

[edoardo_vicendo]

I think that in an Indexer Cluster by default all the Splunk "internal" indexes should have repFactor=auto, at least under /opt/splunk/etc/master-apps/_cluster/default/indexes.conf

I opened the following Splunk Idea to ask for the implementation:

https://ideas.splunk.com/ideas/EID-I-898

[smoir_splunk · Accepted solution]

If you want to modify indexes.conf to add repFactor = auto, follow these steps to recreate the Splunk_TA_ForIndexers and modify the indexes.conf outputted in that package, then deploy that updated package to your indexer cluster.
https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallTechnologyAdd-ons#Create_the_Splunk_TA...

The likely reason this is not set to auto is because repFactor is set to 0 by default, and the Splunk_TA_ForIndexers indexes.conf file combines the indexes.conf files in the add-ons selected when the TA is created. So if the indexes.conf files in those add-ons weren't set to replicate, it wouldn't get added.

I hope this helps!

[adonio]

from the moment you insert the clause, data will replicate according to policies