All my indexer assign to same app

[afolabia]

I created a indexes.conf file and placed it in my_all_indexes to keep them in one central location for easy management, which is in the apps folder on the indexer, forwarder, and deployment apps. Now all of my indexes are pointing to the same app. Is that normal, if not how do i change it back.? If i just delete it from these locations all the other apps goes away except the systems ones. How/where do I change them back. My environment 1 search head, 1 deployment server, 1 indexer, 1 Heavy forwarder, etc

Name Actions Type App Current Size Max Size ? Event Count Status
audit Edit Delete Disable Events my_all_indexes 16 MB 488.28 GB 123K 11 days
_internal Edit Delete Disable Events my_all_indexes 1.43 GB 488.28 GB 13.5M 2 months
_introspection Edit Delete Disable Events mys_all_indexes 1.38 GB 488.28 GB 1.46M 2 months
_metrics Edit Delete Disable Metrics my_all_indexes 571 MB 488.28 GB 6.05M 2 months
_telemetry Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB

msad Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB 0

asa Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB 0

ios Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0

ise Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0

linux Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0

windows Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0

main Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB 0

[gcusello]

Hi @afolabia,
usually indexes.conf is only on Indexers, so I hint to put it in a dedicated App (called e.g. TA_Indexers) and deplit it only on Indexers; if you have indexers.conf in all servers you create your indexes in all server and it isn't correct and unuseful.

For my approach, this is the way to manage all the apps: there is no reason to deploy Search Head Apps on Deployment Server or on Heavy Forwarder, because they cannot run (if you don't configure a distributed search) and you could think that there's a problem.
The best approach is to put the apps in the correct Splunk server:

• TA_indexers on Indexer;
• all your user Apps on Search Head;
• all your TAs on deployment-apps folder of Deployment Server;
• eventual TAs on Heavy Forwarder.

Ciao.
Giuseppe