Splunk Enterprise Security

Install ES on an Indexers Cluster

gcusello
SplunkTrust
SplunkTrust

Hi at all,
probably it's a stupid question, but I don't know very well if ES has special requirements for Indexers Clusters and documentation doesn't help me.
I took in charge a Splunk installation where I found an Indexers Cluster where is installed the Splunk_TA_ForIndexers containing the indexes.conf file for ES correctly deployed using Master Node.
The problem is that in indexes.conf there isn't the clause repFactor = auto in indexes stanzas, so indexes aren't replicated between the cluster!
I know that old events aren't replicated between Indexers, so what it will happen if I insert the clause in indexes.conf?

Thank you for your help.

Bye.
Giuseppe

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

If you want to modify indexes.conf to add repFactor = auto, follow these steps to recreate the Splunk_TA_ForIndexers and modify the indexes.conf outputted in that package, then deploy that updated package to your indexer cluster.
https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallTechnologyAdd-ons#Create_the_Splunk_TA...

The likely reason this is not set to auto is because repFactor is set to 0 by default, and the Splunk_TA_ForIndexers indexes.conf file combines the indexes.conf files in the add-ons selected when the TA is created. So if the indexes.conf files in those add-ons weren't set to replicate, it wouldn't get added.

I hope this helps!

View solution in original post

0 Karma

edoardo_vicendo
Contributor

I think that in an Indexer Cluster by default all the Splunk "internal" indexes should have repFactor=auto, at least under /opt/splunk/etc/master-apps/_cluster/default/indexes.conf

I opened the following Splunk Idea to ask for the implementation:

https://ideas.splunk.com/ideas/EID-I-898

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

If you want to modify indexes.conf to add repFactor = auto, follow these steps to recreate the Splunk_TA_ForIndexers and modify the indexes.conf outputted in that package, then deploy that updated package to your indexer cluster.
https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallTechnologyAdd-ons#Create_the_Splunk_TA...

The likely reason this is not set to auto is because repFactor is set to 0 by default, and the Splunk_TA_ForIndexers indexes.conf file combines the indexes.conf files in the add-ons selected when the TA is created. So if the indexes.conf files in those add-ons weren't set to replicate, it wouldn't get added.

I hope this helps!

0 Karma

adonio
Ultra Champion

from the moment you insert the clause, data will replicate according to policies

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...