topic Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment? in Deployment Architecture

Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

harrymclaren — Thu, 11 Jun 2020 01:28:14 GMT

Hello,

I have built a Splunk testing / staging environment on top of 6 VMs. Splunk version is 6.2.3 and us running on CentOS 6.6.
I have 1 Search Head, 1 Utilities Server (Cluster Master / Deployment Server) and 4 Indexers (Multi Site Cluster).

The cluster has come up and is showing all hosts within the management console.

Search factor is set to 2 and replication factor is set to 3.
The only indexes are _audit and _internal. Searchable data is fine 2/2 but replicated data is 2/3.
Bucket status is showing 8x fixup tasks - pending. I have rebooted the cluster master and peer nodes (rolling restart).

If I view the bucket statuses I get:

Missing enough suitable candidates to create a replicated copy in order to meet replication policy. Missing={ site2:1 }

Any help or advice would be appreciated.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

harrymclaren — Thu, 30 Jul 2015 10:16:56 GMT

The trigger condition is showing:
"Removing peer "

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

harrymclaren — Thu, 30 Jul 2015 13:36:24 GMT

As it's a new build I just cleaned out the indexes and now the issue has gone away:
splunk stop
splunk clean eventdata -index _internal -f
splunk clean eventdata -index _audit -f
splunk start

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

dxu_splunk — Thu, 30 Jul 2015 18:41:11 GMT

See https://answers.splunk.com/answers/134798/splunk-6-1-multi-site-cluster-not-replicating-or-working-as-intended.html#answer-134887

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

mikelanghorst — Fri, 28 Apr 2017 22:41:31 GMT

wiping all data isn't really a realistic answer

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

fabiocaldas — Sat, 06 Jan 2018 01:11:16 GMT

I downvoted this post because i cant remove all data to fix my data issue

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

doe2013 — Tue, 30 Jan 2018 19:51:38 GMT

I downvoted this post because wiping all data doesn't solve the problem

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

nplamondon — Wed, 30 Jan 2019 16:34:29 GMT

I downvoted this post because this isn't a realistic answer and should very clearly state that all data in that index will be destroyed.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

sbattista09 — Wed, 13 Mar 2019 03:04:04 GMT

I downvoted this post because removed data to fix data issue is not a answer.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

effem — Wed, 05 Jun 2019 06:22:29 GMT

I downvoted this post because i downvoted this post because i can't remove all data to fix my data issue

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

kamal_jagga — Fri, 14 Jun 2019 21:13:24 GMT

Any solution for this issue in production for single site clustered environment. Kindly advise.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

mleid — Thu, 31 Oct 2019 14:13:56 GMT

We received the same bucket status as you described on most of our pending fixup actions, both on search factor and replication factor, respectively.

Search factor:

Missing enough suitable candidates to create searchable copy in order to meet replication policy. Missing={ site3:1 }

Replication factor:

Missing enough suitable candidates to create a replicated copy in order to meet replication policy. Missing={ site3:1 }

In our case, we verified all our configurations were correct per the link posted by dxu and elsewhere in the documentation and then just had to wait it out. The status did not go away until our pending fixup actions got into the ~300 range (down from ~30k originally).

So in short, it resolved itself. This was on Splunk 7.3.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

schose — Fri, 29 Nov 2019 08:44:45 GMT

I downvoted this post because data loss.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

louismai — Wed, 30 Sep 2020 04:03:54 GMT

I got a similar issue with 7.3.3 when migrating from single-site to multisite. I found that reducing replication_factor and seach_factor helped the process faster.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

Eric_Mcknight — Thu, 09 Apr 2020 15:37:43 GMT

This is a horrible idea. Deleting data is not the proper way to resolve SF/RF issues.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite ind

woodcock — Wed, 21 Jul 2021 17:35:07 GMT

ATTENTION!!! WARNING!!! This answer is not really a solution: it is deleting all of the buckets and data so DO NOT USE THIS APPROACH IN PRODUCTION or on useful indexed data.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite ind

Anam — Fri, 21 Oct 2022 18:12:02 GMT

I have unaccepted the solution taking the consensus of other folks into consideration.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite ind

veryfoot — Sun, 21 Jan 2024 17:21:07 GMT

Hi all, Im under Splunk Version 9.0.2.

After decomissionning one indexer in a multi site clustering, I cant retrieve my SF / RP.

Rolling restart and restart CM have no effect.

Got 3 SF tasks in pending with the same message as mentionned in this post.

Id like to be clean before decomissionning another indexer.

Any help will be appreciate in order to retrieve my SF/RP

Thanks

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite ind

PickleRick — Sun, 21 Jan 2024 19:10:00 GMT

This is a very old thread. You're unlikely to get an answer from people posting here. It's best if you create a new thread, possibly linking to this one for reference.

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite ind

malisushil119 — Tue, 16 Jul 2024 09:03:58 GMT

dont post wrong answers to delete all the data