Splunk Enterprise

Why my number of indexes are not the same in monitoring console ?

mah
Builder

Hi, 

I removed several indexes from indexes.conf and after the apply, I found that the number of indexes are not the same :

mah_0-1607508908937.png

In the monitoring console, in "Indexes an Volumes: Instance" tab, I found another number : 

mah_1-1607508942982.png

When I run |rest /services/data/indexes and filter on indexes, the count is 376.

Can you explain me why and how to get the same number every place ? 

 

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

@mah , Cluster Master does not show empty indexes on the list. Can you check if missing indexes has any data?

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Howtomonitoracluster#Indexes_tab 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

@mah , Cluster Master does not show empty indexes on the list. Can you check if missing indexes has any data?

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Howtomonitoracluster#Indexes_tab 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

mah
Builder

That's it ! I make a diff and 70 indexes are empty. 

Thanks a lot ! 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

On which instance(s) did you change indexes.conf?  Did you restart Splunk after making the change?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mah
Builder

I did the changes on deployment-server and cluster master.

On cluster master, I apply it on indexers (2 instances) with "splunk apply cluster-bundle" command. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...