In this blog we will be working in our environment to add a new index to our cluster, keep following the steps to add new index in a clsuter.
Below are the Steps To Add New Index in a Cluster –
1) Go to the Indexer Master and Move from root to splunk user.
$ sudo su splunk
2) Edit the indexes.conf
$ vi /opt/splunk/etc/Master_apps/Torstar_all_indexes/local/indexes.conf
3) Add the New index stanza as per Retention Policy. Save it.
4) Then to check and validate the bundle
$ /opt/splunk/bin/splunk validate cluster-bundle
5) To apply that bundle to peers (indexers)
$ /opt/splunk/bin/splunk apply cluster-bundle
6) Then apply a rolling restart to peers(indexers)
$ /opt/splunk/bin/splunk rolling-restart cluster-peers
7) Check the status of bundle
$ /opt/splunk/bin/splunk show cluster-bundle-status
8) After completing this just go to the Peer nodes (indexers) UI settings >> indexes New indexes
should be in the list.
9) Another way to confirm is we can see that index go to Indexer Master in that settings >> index
clustering >> indexes option should show all the replicated indexes.