topic setting up indexer cluster in Deployment Architecture

setting up indexer cluster

raghu0463 — Tue, 29 Sep 2020 22:56:07 GMT

Hi,

I was trying to setup indexer cluster, but in the console its showing the replication factor and search factor or not met ?

got the below error in Splunkd.log

Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=5610983424, elapsed_ms=1
01-26-2019 07:43:28.260 +0000 WARN CacheManager - Unable to evict enough data. Evicted size=0 instead of size=5610983424
01-26-2019 07:43:29.261 +0000 INFO CacheManager - Eviction requested, bytes_needed=5610983424 partition of path=/opt/splunk/var/lib/splunk/audit/db
01-26-2019 07:43:29.261 +0000 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

Re: setting up indexer cluster

dkeck — Sat, 26 Jan 2019 09:34:51 GMT

This sounds like your error

https://answers.splunk.com/answers/620357/unable-to-search-getting-this-error-unable-to-evic.html

Check the things mentioned in this answer

Re: setting up indexer cluster

raghu0463 — Sat, 26 Jan 2019 18:22:57 GMT

How to decrease the free min disk space please ? at this path = /opt/splunk/var/lib/splunk/audit/db

Re: setting up indexer cluster

dkeck — Sun, 27 Jan 2019 08:45:41 GMT

HI, this is set in server.conf

 [diskUsage]
 minFreeSpace = <num>

https://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setlimitsondiskusage

or via CLI

splunk set minfreemb <number>
splunk restart

Re: setting up indexer cluster

dkeck — Mon, 28 Jan 2019 10:48:29 GMT

Please accept the answer if it helped 🙂