Configuring Distributed Indexes

Question

Hi,

I'm planning to use the deployment server to deploy configs to my indexers and use network storage for the cold DB. I have the following in indexes.conf:

[foo]
homePath = $SPLUNK_DB/foo/db
coldPath = /nfs/foo-splunk/storage/foo/colddb
thawedPath = $SPLUNK_DB/foo/thaweddb
maxDataSize = auto_high_volume
maxWarmDBCount = 7
maxTotalDataSizeMB = 220000
frozenTimePeriodInSecs = 1900800

When I have multiple indexes how is this applied? For example is the maxTotalDataSizeMB per indexer or per index?

Can multiple indexers use the same location for the colddb?

Thanks

Answer 1

0

The above stanza will be applied to the foo index only. no matter how many other indexes you have.
maxTotalDataSizeMB will be per index, ie only for the foo index. (if you are deploying this to more then one indexer, this will be so for all those indexers, but again, only for the foo index.)

You can NOT use the same location for multiple indexers (otherwise you would have clashes between the data). If you want to use the same nfs then you should probably create directories for all your indexers say:

/nfs/indexer1/foo/
/nfs/indexer2/foo/
etc..

link

answered 24 Mar '11, 16:32

Genti ♦
3.5k●1●22
accept rate: 36%

Thanks Genti. I understand that this config only applies to the foo index I'm trying to clarify what happens when this index is distributed across multiple indexers. You say that maxTotalDataSizeMB would apply to all indexers. Does that mean it has the same limit on each indexer or that the limit is across all indexers?

Is the hostname available as a variable in indexes.conf so I can do /nfs/$HOSTNAME/foo/ and deploy the same config to all indexers?

(25 Mar '11, 10:57) craigmunro

you should NOT have all your indexers read and write files to that exact same folder on the NFS. If you set them up in different directories, then maxTotalDataSizeMB will apply to a single indexer/index. Hence if you say 10 Gig, and then each indexer will have 10Gig max for that index. if you have 10 indexers, each of 10 Gig for the particular index, then you need 100Gigs...

(25 Mar '11, 23:26) Genti ♦

Answer 2

0	Setting the coldPath as /nfs/$HOSTNAME/foo in indexes.conf works which means I can use the deployment server to configure my indexers. link answered 01 Apr '11, 13:19 craigmunro 65●3 accept rate: 0%

Configuring Distributed Indexes

Follow this question

Splunk Resources

Related questions