I have increase the Max Size of the "main" index at indexer clustering master node. I tried to push it to the peer node, it showed successful and I have also restart the peer node (Server Control --> Restart Splunk).
The Max Size of the "main" index is still not updated.
Splunk Enterprise version: 8.2
You need to create an `indexes.conf` file in either `/opt/splunk/etc/manager-apps` or `/opt/splunk/etc/master-apps`. Afterward, push the configuration, and it will appear on the indexers under `/opt/splunk/etc/peer-apps`.
The main index serves as the default index. I recommend creating a new index and applying the desired settings. Then, navigate to the cluster master and push the changes using the following command:
/opt/splunk/bin/splunk apply cluster-bundle
Afterward, check the bundle status.
For an Indexer cluster, use the CLI on the Cluster Master to run:
/opt/splunk/bin/splunk show cluster-bundle-status
How to you verified that the parameter was not updated? Have you checked the changed indexes.conf on a peer node?
If not, please check it and execute $SPLUNK_HOME/bin/splunk btool indexes list main --debug to check the parameter and its app location.
It’s possible that another indexes.conf file takes precedence over your modified configuration.