Sanity check please re: Splunk indexer remote storage configuration
(1) Our indexers are set up in a clustered environment, and originally frozen buckets were moved to a local external location using coldToFrozenPath.
(2) We are now trying to use a script to have all frozen buckets written to AWS, and the app containing the updated indexes.conf was distributed using the master node
Script to move / freeze buckets to AWS is working, validated again by checking date / time stamps of last written files
(3) However, we are STILL getting "duplicate" buckets being written to the local storage instance, even though everything SHOULD only be written to AWS
When looking at the pertinent indexes in the web GUI, the Frozen Path is still set, even though it has been removed completely from the deployed app's indexes.conf, and verified on the indexers in /peer-apps/xxxx/local/indexes.conf
Trying to manually remove the frozen path in the GUI doesn't work, "not allowed in a clustered environment"
(4) When trying to find out the 5W's, I've noticed that there is an /opt/splunk/etc/system/local/indexes.conf that ALSO exists on each indexer, and this version still uses the Frozen Path to the local storage.
Question:
Since the deployed peer-apps indexes.conf with the script does seem to be working correctly, is it safe (relative) for me to remove the /system/local/indexes.conf?
... View more