search

splunk / splunk-operator

Splunk Operator for Kubernetes
Other
206 stars 114 forks source link

S2S/HEC enabled on indexer before first bundle causes data loss #58

Closed ryanfaircloth closed 4 years ago

ryanfaircloth commented 4 years ago

The current deployment uses ansible to enable inputs in etc/system/local this is dangerous because when scaling or simply a race condition the indexer will not be aware of its indexes and data will be lost when in an indexer cluster no more should be configured than is required to join the cluster. The master apps folder must be used to push inputs.conf

mikedickey commented 4 years ago

Moving this to splunk-ansible https://github.com/splunk/splunk-ansible/issues/439