Indexer Clustering Setup and Configuration

[@filipkuczak3426]

Everytime I watch one of Your videos I feel so gratefull for such easy and detailed explanation. Thank You so much for Your amazing work !

[@neeraj79]

HI Sid, Post the Indexer cluster setup next step is to get the data in. Request to do a video on how to connect Universal forwarders to an Indexer cluster via Indexer discovery.

[@nischaldu4983]

Hi, im getting this error while setting up the indexer clustering Cannot fix search count as the bucket hasn't rolled yet.

[@kostralian]

you saved my ass. please keep up the good work

[@qawsfgtwgshsghsfdvf]

Nice video. I wish you had made one of peer mode changes via the command line.

[@grainfrizz]

Here's a tip: once you've successfully configured the indexer clustering, you may (or I should say, must) turn off Splunk Web and Transparent Huge Pages on the indexer peers.

[@rajkumarkandasamy917]

I agree with this, this is the standard we follow on the peer nodes

[@karthigeyan0]

@splunk_ml Hi Bro, I am thank you for videos which you posting really and easy to understand. I need more videos like, 1. Step by step Upgrade of Splunk version in cluster environment 2.Need more video of ITSI Thanks, Karthigeyan R

[@on27042011]

Beautifully explained buddy. 🙏

[@splunk_ml]

🙏

[@rajam5399]

Hi sid, if I have indexer with all data which we had earlier, now if i want to change that to indexer cluster as Indexer1 and other two as new indexers 2&3 then data in indexer 1 will get replicated to indexer 2&3 after enabling clustering? I was bit skepticAl that how it works. Please help

[@Hughzhou]

hi， I have to say this is a nice video, but, i would like to know why there is no subtitles, you know, i/m not good at English, I would like to learn details about cluster, I searched for similar videos for a long time until I met you，I want to build the architecture by myself for my study, because i'm a new guys for Splunk, i found there is subtitle in your new video, could you tell me how to find subtitles for this video or is there any way I can see the subtitles? thanks sooo~ much,

[@adarshmahi8019]

Hey Sid, Thanks again for this informative video. Would you like to make a video on splunk upgrade and especially dos & don'ts while upgrading splunk clustered environment in production region..?

[@splunk_ml]

I will definitely try to cover that Atul.

[@saibollam10]

@@splunk_ml i also wanted you to make a video on splunk upgrade

[@gisellelopez8923]

Hi Sid. Do you have a tutorial for indexer clustering and search head clustering without opening the Splunk Web UI? Just using the backend -- CLI commands?

[@splunk_ml]

Nope..but this is a good idea...I will create one.

[@rajivaws6975]

HI Sir...I have one very basic doubt for which i couldn't've find any answer anywhere...Suppose i have an environment of 10 indexer with RF=3 and SF=3 so does it mean it will have 3 copies of each bucket on each of 10 indexer like idx1 will have 3 copies idx2 will have 3 copies idx 3 will have 3 copies idx4 will have 3 copies idx5 will have 3 copies....idx10 will have 3 copies or is it like 3 copies will be there across all indexers....if 3 copies of each buckets are present across all indexer than how bucket fixing activity will perform in case 5 indexers are down assuming three out of this 5 down indexers will have bucket copies and those indexers which is up will not have any bucket copies. So is it idle to have high RF value in an environment of 10 indexers.

[@mahindrakalyan2479]

Hi Admin...First of all thank you very much for the uploads...I am in search of Splunk related videos from past 2 weeks... Yesterday I saw your channel and went though playlists...There I found 81 videos which are related to development... My query is, I am looking for switching the company, are these 81 videos enough for 2-3 years experience candidate? Or if you suggest anything apart from these 81 videos... Thank you in advance...

[@splunk_ml]

Hi Mahindra, You will have really strong base once you complete those 81 videos and I am still adding more to that playlist. I would suggest go through them all and just search interview questions in Google and take a glance at them, you should be fine. Best of luck 👍

[@mahindrakalyan2479]

@@splunk_ml Looking forward to learn more from this channel...

[@rajkumarkandasamy917]

Thanks again for your videos, Quick question, as per your video, free license doesn't meet the replication factor, am i correct. but when we do the indexer clustering, how does the dashboard shows that Rep factor is met? could you please explain this

[@splunk_ml]

In Splunk free license you can't configure cluster. The splunk I was using its 60 days trial which is enterprise license. There is another splunk version you can download called "Splunk free", there you can't configure cluster.

[@amith5122]

Can we deploy this conf via deployment server ?

[@divyasetia12]

Hi sir, kindly try to create videos on multisite clustering also and also some admin related troubleshooting videos

[@splunk_ml]

Yes I will cover them eventually.

[@hanueai]

can you give demo on SEIM administration using SPLUNK ?

[@cexesp2022]

thanks for the awesome video , perfect bro

[@penchum6722]

Are you help me to attended the splunk certification exam

[@grainfrizz]

Rep and search factor numbers won't be written on server.conf in system/local because Splunk will just use the one in system/default.

[@splunk_ml]

Yes that's true... I should have mentioned that in video... Thank you

[@gaminginsect7143]

Can you provide link how you added a new index and then replicated it across the cluster

[@splunk_ml]

Yes I will soon cover that.

[@gaminginsect7143]

@@splunk_ml Ok thank u.

[@mahip1869]

Hi siddarth, How to delete events on cluster environment ?

[@thirumalreddy4521]

Thanks Sid

[@kesavaprasad7958]

Hi sir plz send generalissues come across in splunk admin.