Steps To Add New Index in a Cluster

In this blog we will be working in our environment to add a new index to our cluster, keep following the steps to add new index in a cluster.

Below are the Steps To Add New Index in a Cluster –

1)    Go to the Indexer Master and Move from root to splunk user.
        $ sudo su splunk

2)    Edit the indexes.conf
        $    vi /opt/splunk/etc/Master_apps/Torstar_all_indexes/local/indexes.conf

3)    Add the New index stanza as per Retention Policy. Save it.

4)    Then to check and validate the bundle
        $  /opt/splunk/bin/splunk validate cluster-bundle

5)    To apply that bundle to peers (indexers)
        $ /opt/splunk/bin/splunk apply cluster-bundle 

6)    Then apply a rolling restart to peers(indexers)
        $ /opt/splunk/bin/splunk rolling-restart cluster-peers

7)    Check the status of bundle
        $ /opt/splunk/bin/splunk show cluster-bundle-status

8)    After completing this just go to the Peer nodes (indexers) UI settings >> indexes New indexes
       should be in the list.

9)    Another way to confirm is we can see that index go to Indexer Master in that settings >> index
       clustering >> indexes option should show all the replicated indexes.