All Apps and Add-ons

Installing the Splunk Add-On for Unix and Linux in an indexer cluster, do I have to enable repFactor=auto?

amielke
Communicator

I will install the app Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833/ ) in an indexer cluster. The inputs are described in the documentation, but the index is not described.

Must I use repFactor = auto and create a new file in the local folder?

0 Karma
1 Solution

lguinn2
Legend

Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix and SA-nixboth have index definitions.

View solution in original post

lguinn2
Legend

Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix and SA-nixboth have index definitions.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...