Hi everyone, I’m currently working with a Splunk distributed clustered environment (v9.4.1), with 3 indexers, 3 search heads and 1 cluster master, on RHEL. I recently added a second 500GB disk t...
See more...
Hi everyone, I’m currently working with a Splunk distributed clustered environment (v9.4.1), with 3 indexers, 3 search heads and 1 cluster master, on RHEL. I recently added a second 500GB disk to each indexer in order to separate hot/warm and cold bucket storage. I have set up and mounted the 500GB disks hoping that should differentiate between the /indexes and the /coldstore. I also edited the indexes.conf file on the cluster master, an example is shown below: [bmc] homePath = /indexes/bmc/db coldPath = /coldstore/bmc/colddb thawedPath = $SPLUNK_DB/bmc/thaweddb repFactor = auto maxDataSize = auto_high_volume I then applied the cluster-bundle as well as gave it a rolling-restart just in case. Even though (I think) that I have configured everything correctly, when I navigate to the cluster master GUI and go to the path Settings → Indexer Clustering → Indexes The indexes tab is empty, with none of the default indexes or the custom indexes that I had made. Has anyone encountered this behaviour where indexes do not appear in the Clustering UI, despite valid indexes.conf and bundle deployment?