https://community.splunk.com/t5/Splunk-Enterprise/Cluster-Node-SearchFactor-not-met/m-p/701214#M20435 <P>I'm creating a splunk multisite cluster. the configuration is done as the documentation shows, so I did with the cluster node. all peers show up and tell me they are up and are happily replicating. but for whatever reason the search factor and replication factor is not met.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="avoelk_0-1728314739479.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32983i677D3AC94C3E057B/image-size/medium?v=v2&amp;px=400" role="button" title="avoelk_0-1728314739479.png" alt="avoelk_0-1728314739479.png" /></span></P><P>the notification about the unhealthy system tells me it's the cluster node :&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="avoelk_1-1728314836887.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32984i970F91DC75470A1B/image-size/medium?v=v2&amp;px=400" role="button" title="avoelk_1-1728314836887.png" alt="avoelk_1-1728314836887.png" /></span></P><P>&nbsp;</P><P>but - why is that? how can I check what is wrong with it? If I look up the cluster status it all seems fine (via cli)</P><P>&nbsp;</P> Mon, 07 Oct 2024 15:28:22 GMT avoelk 2024-10-07T15:28:22Z https://community.splunk.com/t5/Splunk-Enterprise/Cluster-Node-SearchFactor-not-met/m-p/701214#M20435 <P>I'm creating a splunk multisite cluster. the configuration is done as the documentation shows, so I did with the cluster node. all peers show up and tell me they are up and are happily replicating. but for whatever reason the search factor and replication factor is not met.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="avoelk_0-1728314739479.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32983i677D3AC94C3E057B/image-size/medium?v=v2&amp;px=400" role="button" title="avoelk_0-1728314739479.png" alt="avoelk_0-1728314739479.png" /></span></P><P>the notification about the unhealthy system tells me it's the cluster node :&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="avoelk_1-1728314836887.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32984i970F91DC75470A1B/image-size/medium?v=v2&amp;px=400" role="button" title="avoelk_1-1728314836887.png" alt="avoelk_1-1728314836887.png" /></span></P><P>&nbsp;</P><P>but - why is that? how can I check what is wrong with it? If I look up the cluster status it all seems fine (via cli)</P><P>&nbsp;</P> Mon, 07 Oct 2024 15:28:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/Cluster-Node-SearchFactor-not-met/m-p/701214#M20435 avoelk 2024-10-07T15:28:22Z https://community.splunk.com/t5/Splunk-Enterprise/Cluster-Node-SearchFactor-not-met/m-p/701219#M20438 <P>Hello, do you see any corrupt buckets? Sometimes restarting the CM has been known to clear the bucket fix up stuck tasks in the past.<BR /><BR />Refer:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.3.1/Indexer/Anomalousbuckets" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.1/Indexer/Anomalousbuckets</A></P> Mon, 07 Oct 2024 15:53:50 GMT https://community.splunk.com/t5/Splunk-Enterprise/Cluster-Node-SearchFactor-not-met/m-p/701219#M20438 sainag_splunk 2024-10-07T15:53:50Z