Deployment Architecture

Need help in Replication.

vikcee
Path Finder

Hello All,

I have created a Indexer cluster. In my master indexer I created one Index and added some data (/etc/master-app/_cluster/local). and pushed the index to all the peers. Index is replicated in all the indexer But data is showing in only master index. Now I want to add some data to all my indexer. What should I do?

Thanks
Vikash Gupta

0 Karma
1 Solution

woodcock
Esteemed Legend

There is no such thing as a Master Indexer. You should have a created an app inside of master-apps on the Cluster Master that contains an indexes.conf file. DO NOT create any splunk configuration files for this directly on any indexers. Then push out the indexes.conf app (which has the file) using the cluster commands on the Cluster Master. This will cause a rolling restart on the Indexers once they receive the new configurations, after which you will be able to send data to the new index on the indexers.

View solution in original post

0 Karma

woodcock
Esteemed Legend

There is no such thing as a Master Indexer. You should have a created an app inside of master-apps on the Cluster Master that contains an indexes.conf file. DO NOT create any splunk configuration files for this directly on any indexers. Then push out the indexes.conf app (which has the file) using the cluster commands on the Cluster Master. This will cause a rolling restart on the Indexers once they receive the new configurations, after which you will be able to send data to the new index on the indexers.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We may have a terminology problem. There is no such thing as a "master indexer". The instance in charge of an indexer cluster is the "Master Node" or "Cluster Master". A clustered indexer cannot serve as the Master.
Defining an index on the Master Node (MN) and pushing the configuration to the peers will define that index on all indexers.
All of your Splunk instances should be forwarding their output to the indexers. Not only does that make all Splunk logs searchable, but it also means data added on the MN or a Search Head will be sent to the indexers and replicated properly.

---
If this reply helps you, Karma would be appreciated.
0 Karma

p_gurav
Champion

Could you share the indexes.conf? Also, on which Splunk instance wrote your inputs.conf?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...