Deployment Architecture

How to configure a new index via Splunk Web in an indexer clustering environment?

horsefez
SplunkTrust
SplunkTrust

Hi Splunkers!

I have a problem when I'm trying to distribute new indexes made via Splunk Web on the master-node of my indexer cluster.

I already know how to configure new indexes via indexes.conf on the master and how to distribute them via apply cluster-bundle.
This works fine!

Today, I tried to do the same thing via Splunk Web. The new index gets created and is displayed on the master, but when I'm trying to hit deploy, the following message shows:

In handler 'clustermastercontrol': No new bundle will be applied. The master and peers already have this bundle with bundle id = ....

How do I get the configured index onto the cluster peers?

Thanks in advance!

Kind regards,
pyro_wood

0 Karma
1 Solution

lycollicott
Motivator

Your master node should not have any indexes on it. The only way to create them on the peers is with indexes.conf and a bundle.
Sorry, dude.

View solution in original post

0 Karma

frmaasdam
Path Finder

You can creatie an app containing the needed indexes.conf and place it in de directory ../etc/master-apps/ on the master node.
An apply-cluster-bundle should distribute the indexes to all peer nodes.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can't create indexes using web in indexer cluster. See the doc http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes

Important: You cannot use Splunk Web or the CLI to configure index settings on peer nodes. You must edit indexes.conf directly

The index you have created is local for master and you shouldn't be using that index to store data , forward all data from master also to peer indexers instead

lycollicott
Motivator

Your master node should not have any indexes on it. The only way to create them on the peers is with indexes.conf and a bundle.
Sorry, dude.

View solution in original post

0 Karma

horsefez
SplunkTrust
SplunkTrust

Thank you very much lycollicott. I miss those key information in the splunk docs.
Maybe I've overlooked it, but I think this information isn't in there.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!