topic Re: Search Factor and Replication factory not met. Frozen=1 in Splunk Enterprise

Search Factor and Replication factory not met. Frozen=1

jfaldmomacu — Thu, 07 Jan 2021 18:02:51 GMT

I have started seeing this message often on my Indexer Cluster Master, when I view the Bucket Status page.

bid=_internal~7404~4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX removed from peer=4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX, frozen=1

The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet. I try to roll them but nothing happens.

Does frozen=1 mean it is old data and since we don't have a frozen volume then I can delete these buckets?
Any other suggestions on how to address this?

Re: Search Factor and Replication factory not met. Frozen=1

jdhunter — Mon, 10 May 2021 16:54:08 GMT

I'm seeing these messages as well now that I have upgraded to 8.1.3 (from 7.3.3)

Re: Search Factor and Replication factory not met. Frozen=1

jfaldmomacu — Mon, 10 May 2021 19:36:27 GMT

I found I needed to Resync the buckets and that fixed the issue.