Splunk Enterprise

Why my number of indexes are not the same in monitoring console ?

mah
Builder

Hi, 

I removed several indexes from indexes.conf and after the apply, I found that the number of indexes are not the same :

mah_0-1607508908937.png

In the monitoring console, in "Indexes an Volumes: Instance" tab, I found another number : 

mah_1-1607508942982.png

When I run |rest /services/data/indexes and filter on indexes, the count is 376.

Can you explain me why and how to get the same number every place ? 

 

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

@mah , Cluster Master does not show empty indexes on the list. Can you check if missing indexes has any data?

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Howtomonitoracluster#Indexes_tab 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

@mah , Cluster Master does not show empty indexes on the list. Can you check if missing indexes has any data?

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Howtomonitoracluster#Indexes_tab 

If this reply helps you an upvote is appreciated.
0 Karma

mah
Builder

That's it ! I make a diff and 70 indexes are empty. 

Thanks a lot ! 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

On which instance(s) did you change indexes.conf?  Did you restart Splunk after making the change?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

mah
Builder

I did the changes on deployment-server and cluster master.

On cluster master, I apply it on indexers (2 instances) with "splunk apply cluster-bundle" command. 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>