Latest Updates


Steps To Add New Index in a Cluster

Below are the Steps To Add New Index in a Cluster -

1)    Go to the Indexer Master and Move from root to splunk user.
        $ sudo su splunk

2)    Edit the indexes.conf
        $    vi /opt/splunk/etc/Master_apps/Torstar_all_indexes/local/indexes.conf

3)    Add the New index stanza as per Retention Policy. Save it.

4)    Then to check and validate the bundle
        $  /opt/splunk/bin/splunk validate cluster-bundle

5)    To apply that bundle to peers (indexers)
        $ /opt/splunk/bin/splunk apply cluster-bundle 

6)    Then apply a rolling restart to peers(indexers)
        $ /opt/splunk/bin/splunk rolling-restart cluster-peers

7)    Check the status of bundle
        $ /opt/splunk/bin/splunk show cluster-bundle-status

8)    After completing this just go to the Peer nodes (indexers) UI settings >> indexes New indexes
       should be in the list.

9)    Another way to confirm is we can see that index go to Indexer Master in that settings >> index
       clustering >> indexes option should show all the replicated indexes.
Steps To Add New Index in a Cluster Reviewed by Avotrix.Author on Monday, January 14, 2019 Rating: 5

No comments:

All Rights Reserved by Avotrix © 2018 - 2019
Developed and created by Avotrix

Contact Form


Email *

Message *

Powered by Blogger.