Getting Data In

Indexes.conf question

adalbor
Builder

Hey All,
I have a question surrounding the best way to deploy the indexes.conf in our environment.

We currently have our indexes.conf deployed to our indexers, heavy forwarders, and ES. We deploy to our HF's as we have different data inputs on them and need the index information there for the config options to show in the GUI.

Today I setup a cold path that only the indexers have access to and deployed the new indexes.conf with that path specified to everything. Upon doing that the Splunk service complained about the path not existing on the HF's and wouldn't start back up during its initial check.

Whats the best way to ensure the HF's get the indexes.conf without running into the path issue? Once I configure the cold path for all of our indexes it will throw the same error message.

We manage all of this through server classes on our deployment server. The indexes.conf is in its own app that is assigned to server classes for the indexers, HF's and ES box.

Thanks,
Andrew

1 Solution

traxxasbreaker
Communicator

In many deployments, indexes.conf settings defining a volume would be placed in different apps for different parts of the infrastructure. These apps would use the same volume names as those used in your larger indexes.conf where all the indexes are defined, but they would use paths relevant to the parts of the infrastructure they get deployed to.

The volume app that the indexers get would be deployed only to them from the deployment server and would have the correct path definitions for the indexers. There would be a separate volume app for the deployment server to send to any other instances getting the indexes.conf configurations that would have the volumes defined using paths that would exist on those instances.

View solution in original post

0 Karma

traxxasbreaker
Communicator

In many deployments, indexes.conf settings defining a volume would be placed in different apps for different parts of the infrastructure. These apps would use the same volume names as those used in your larger indexes.conf where all the indexes are defined, but they would use paths relevant to the parts of the infrastructure they get deployed to.

The volume app that the indexers get would be deployed only to them from the deployment server and would have the correct path definitions for the indexers. There would be a separate volume app for the deployment server to send to any other instances getting the indexes.conf configurations that would have the volumes defined using paths that would exist on those instances.

0 Karma

adalbor
Builder

So if we wanted to deploy to the HF's we would just use the default paths then?

0 Karma

traxxasbreaker
Communicator

Yes, that would be the normal setup for anything that isn't an indexer.

0 Karma

adalbor
Builder

Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...