HI
We have installed a SH and 4 INDEXERS(Non Clustered). We have installed our app to the SH only with our indexers=mlc_live and or datamodels.
We have set up the forwarders to send data to the INDEXERS, however the SH is giving us errors saying
"Search peer hp400srv_6000_INDEXER1 has the following message: Received event for unconfigured/disabled/deleted index=mlc_live with source="source::/net/dell429srv/dell429srv1/apps/QCST_RSAT_v3.1.43_SEC1/logs/traces/mxtiming_286120_dell429srv_80849.log" host="host::NICKNAME" sourcetype="sourcetype::MX_TIMING2".
So the INDEXERS dont know about the Index=MLC_LIVE, so 3 questions
How do i set up the indexers on the indexes
How do i set up the datamodels on the indexes
Should i use this
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Updatepeerconfigurations
Cheers in advance
Rob
↧