topic Re: replication error messages in Deployment Architecture

replication error messages

alextsui — Wed, 29 Dec 2010 09:37:12 GMT

Hi, During ad hoc searches we are getting messages "unable to distribute to peer named splunk_index01 at url https://10.1.6.1:8089 because replication was unsuccessful replicationStatus in progress". And when this message displayed, the search results were incorrect. We were getting less events in search resutls than expected. Is there a way to avoid this error? The size of the replication was approximately but less than 300MB. And we had excluded the lookup tables in replication using the configuration below:

[replicationBlacklist] donotreplicate = .../*.csv

Thanks.

Re: replication error messages

Stephen_Sorkin — Thu, 30 Dec 2010 01:00:29 GMT

If all the machines are on a LAN, the best way to make replication faster is to disable splunkd SSL. I'd suggest checking what are the large files being replicated on the indexer in $SPLUNK_HOME/var/run/searchpeers/<indexer>/<newest subdir>.

Re: replication error messages

dmlee — Wed, 05 Jan 2011 19:31:11 GMT

Hi, we had already disabled SSL , but replication failed message still appeared as usual.

in server.conf (search head)
[sslConfig]
enableSplunkSSL = false

we had restarted splunk service after modified server.conf

Re: replication error messages

dmlee — Wed, 05 Jan 2011 19:40:01 GMT

BTW, I had already set
[replicationBlacklist] donotreplicate = .../*.csv
but all *.csv files are still been replicated
we use Splunk 4.1.4.

Re: replication error messages

Stephen_Sorkin — Thu, 06 Jan 2011 02:26:38 GMT

The blacklist setting was added in 4.1.5. SSL must be disabled on the indexers. If on set on the search head, it will fall back to SSL in order to communicate with the indexers which are configured to speak only SSL.

Re: replication error messages

dmlee — Thu, 06 Jan 2011 07:48:07 GMT

thank Stephen, You remind me of Splunk 4.1.4 doesn't support Blacklist.
before we upgrade to 4.1.5 can we use "replicationWhitelist = .../*.conf" to avoid replicate *.csv files ?

Re: replication error messages

Stephen_Sorkin — Fri, 07 Jan 2011 08:04:45 GMT

The replicationWhitelists act as a union, so you'd have to remove the other ones.