Now that you have defined your indexes in indexes.conf file(s), and where needed, defined your custom source types in props.conf and perhaps a transforms.conf file, you need to get these files distributed to all the indexers in the cluster so that they can use them to parse the incoming data properly from forwarders and/or other data sources that reference those indexes and sourcetypes in their inputs.conf files, and store the parsed data in the appropriate index. Each indexer in the cluster must be working with identical configuration files – this configuration file distribution is accomplished by using the cluster master.
In similar fashion as is done to distribute apps from a deployment server, you distribute apps containing indexes.conf and any other configuration files by creating apps directories in a $SPLUNK_HOME/etc/master-apps folder on...
