Deployment Architecture

Splunk shows cluster-status --verbose only shows 'main' index

kutzi
Path Finder

We have an indexer cluster with several custom indexes configured in the indexes.conf, however when we run:

 

splunk show cluster-status --verbose

 

only the main index shows up (among internal _ indexes).
What could be the reason for that?

When searching via the search heads, the indexes all work fine.

Labels (1)
0 Karma
1 Solution

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

View solution in original post

0 Karma

kutzi
Path Finder

The same applies to the Monitoring Console in the Web UI BTW

Tags (1)
0 Karma

kutzi
Path Finder

That had been a major indexes.conf misconfiguration on our side.
In fact our indexes were not replicated at all, because we didn't have the repFactor=auto set on them.
Cf. https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Configurethepeerindexes

After fixing that the indexes appear in show cluster-status --verbose and in the UI

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...