I will install the app Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833/ ) in an indexer cluster. The inputs are described in the documentation, but the index is not described.
Must I use repFactor = auto and create a new file in the local folder?
Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto
set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix
and SA-nix
both have index definitions.
Yes, if you want the indexes created by the app to be replicated, you should create an indexes.conf file in the local folder. Each index to be replicated should have a stanza, with repFactor = auto
set.
Once you have made this edit to your Splunk App for Unix and Linux, you can deploy it via your cluster master. BTW, I believe that you will need to update the index definitions in multiple places to make everything work: Splunk_TA_nix
and SA-nix
both have index definitions.