topic Re: bucket status an change masks failed in Splunk Enterprise

bucket status an change masks failed

jariw — Wed, 26 May 2021 10:05:45 GMT

Hi,

two questions

One : In our environment we have got a multi site cluster with multiple peers. In the bucket status we have got much errors which the fixe up reason "change masks failed" and with current status "Cannot replicate as bucket hasn't rolled yet" .

Whats does that "change masks failed" mean? And what to do about it?

Second question, is there a possibility to resync the buckets with a cli command or other command line to sync multiple buckets (say about a 1000+ buckets) ? Doing them all by hand is ... let's say.... time consuming

thanx in advance for the answer.

greetz

Jari

Re: bucket status an change masks failed

isoutamo — Wed, 26 May 2021 13:43:15 GMT

In 8.1.3 and 8.1.4 (at least) seems to be bug (not confirmed by splunk yet) which try to replicate already partially frozen buckets. See more https://community.splunk.com/t5/Deployment-Architecture/Frozen-Buckets-with-Error-Cannot-replicate-as-bucket-hasn-t/m-p/552748#M18835

Basically you could create shell/python etc. scripts which you could use for syncing.

r. Ismo

Re: bucket status an change masks failed

jariw — Wed, 26 May 2021 14:34:00 GMT

Hi R. Ismo.

Thanks for the link. I am already checking it out. Could you give me a clue for the python script?? Or a link to some info?

Thanx in advance

Greets

jari

Re: bucket status an change masks failed

jariw — Thu, 27 May 2021 05:57:26 GMT

Restarting the CM did the trick. Al the fixup tasks are gone. It is temperarely, they come back slowly .. Waiting for the fix in the future..

Re: bucket status an change masks failed

isoutamo — Thu, 27 May 2021 06:36:40 GMT

Have you already reported this to splunk support? If not please do it. And you should mention that there is already couple of other tickets for that issue.

Re: bucket status an change masks failed

jariw — Thu, 27 May 2021 06:49:08 GMT

Just reported it (thanx for the advise). Lets wait for a solution, clicking the status warnings away is not amusing...

Re: bucket status an change masks failed

isoutamo — Mon, 31 May 2021 06:44:42 GMT

Short update for this case.
In our multisite cluster this issue has vanished as all those buckets have frozen now. We are still investigating this with splunk, but lets see if they can reproduce this in their own environment as this didn't seem to be common issue.