All Apps and Add-ons

Installing the Splunk Add-On for Unix and Linux in an indexer cluster, do I have to enable repFactor=auto?

amielke
Communicator

I will install the app Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833/ ) in an indexer cluster. The inputs are described in the documentation, but the index is not described.

Must I use repFactor = auto and create a new file in the local folder?

0 Karma
1 Solution

lguinn2
Legend

Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix and SA-nixboth have index definitions.

View solution in original post

lguinn2
Legend

Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix and SA-nixboth have index definitions.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...