SPLUNK ARCHITECTURE : DISTRIBUTED WTH INDEXER CLUSTERING

Показать описание

Configuring using CLI:

1. go to the local directory by following path :
/opt/splunk/etc/system/local

[clustering]
mode = master
replication_factor = 3
search_factor = 2
cluster_label = cluster1

3. run the following command :

sudo /opt/splunk/bin/splunk edit cluster-config -mode master -replication_factor 3 -search_factor 2 -secret *****

4. restart the instance :

sudo /opt/splunk/bin/splunk restart

5. Go into every indexer and add indexer into a cluster master

7. restart the instance :

sudo /opt/splunk/bin/splunk restart

8.Go into search head and run :

sudo /opt/splunk/bin/splunk restart