Deployment Architecture

Migrating files from etc/system to slave-apps in cluster


Hi, i was running a single indexer which has props / transforms in etc/system/local.

The indexer was migrated to an indexer cluster, with the other cluster nodes not having the configs. Data is only being sent to the old indexer (which is part of the ckuster).

What effect on incoming data would pushing modified props / tranforms from the cluster master's master-apps to slave apps on the indexers have? I.e. the node receiving data will have duplicate configs for a short period.

Props and transforms do event matching / tagging and regex search / replace.

0 Karma

Ultra Champion

No Problem.

That would be the suggested route.
Duplicated configs in this case are no problem (especially if identical), but you would be well advised to remove the original system/local config once the cluster bundle has been applied.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...