https://community.splunk.com/t5/Splunk-Dev/replication-was-unsuccessful-replicationStatus-Failed-failure/m-p/237624#M3012 <P>Hi rusty009, this seems like an issue with the bundle size, or otherwise some issue with the search head transmitting the bundle to the indexer. This is a tarball of config files, which tends to grow over time, and usually gets tipped over the edge by large lookup files.</P> <P>My recommendation is to look at the internal log for the indexers and search on </P> <PRE><CODE>index=_internal method=POST status!=200 source="*splunkd_access.log" </CODE></PRE> <P>If you find events indicating issues, you can configure replicationBlacklist in server.conf to stop certain files or directories from being included in the bundle, or otherwise remove unneeded files entirely.</P> Tue, 08 Mar 2016 19:42:54 GMT muebel 2016-03-08T19:42:54Z https://community.splunk.com/t5/Splunk-Dev/replication-was-unsuccessful-replicationStatus-Failed-failure/m-p/237623#M3011 <P>Hi ,</P> <P>I'm seeing a weird issue in splunk– I am getting the below error on my search head,</P> <P>• Unable to distribute to peer named pdc1secsplkidx3 at uri <A href="https://10.100.50.13:8089" target="_blank">https://10.100.50.13:8089</A> because replication was unsuccessful. replicationStatus Failed failure info: failed_because_NONE<BR /> • Unable to distribute to peer named pdc1secsplkidx2 at uri <A href="https://10.100.50.12:8089" target="_blank">https://10.100.50.12:8089</A> because replication was unsuccessful. replicationStatus Failed failure info: failed_because_NONE<BR /> • Unable to distribute to peer named pdc1secsplkidx1 at uri <A href="https://10.100.50.11:8089" target="_blank">https://10.100.50.11:8089</A> because replication was unsuccessful. replicationStatus Failed failure info: failed_because_NONE</P> <P>those are my three indexers, when I restart the searchead it works for about 5 minutes and then it doesn’t seem to be able to search any data.</P> <P>I can search historic data (no earler than yesterday) fine on the CM, so I think there is an issue with the search head,</P> <P>Where can i look further?</P> Tue, 29 Sep 2020 09:00:59 GMT https://community.splunk.com/t5/Splunk-Dev/replication-was-unsuccessful-replicationStatus-Failed-failure/m-p/237623#M3011 rusty009 2020-09-29T09:00:59Z https://community.splunk.com/t5/Splunk-Dev/replication-was-unsuccessful-replicationStatus-Failed-failure/m-p/237624#M3012 <P>Hi rusty009, this seems like an issue with the bundle size, or otherwise some issue with the search head transmitting the bundle to the indexer. This is a tarball of config files, which tends to grow over time, and usually gets tipped over the edge by large lookup files.</P> <P>My recommendation is to look at the internal log for the indexers and search on </P> <PRE><CODE>index=_internal method=POST status!=200 source="*splunkd_access.log" </CODE></PRE> <P>If you find events indicating issues, you can configure replicationBlacklist in server.conf to stop certain files or directories from being included in the bundle, or otherwise remove unneeded files entirely.</P> Tue, 08 Mar 2016 19:42:54 GMT https://community.splunk.com/t5/Splunk-Dev/replication-was-unsuccessful-replicationStatus-Failed-failure/m-p/237624#M3012 muebel 2016-03-08T19:42:54Z