topic Re: [Cluster] What is .rbsentinel file ??? in Getting Data In

[Cluster] What is .rbsentinel file ???

rbal_splunk — Tue, 29 Sep 2020 23:17:32 GMT

What is .rbsentinel ???

The log files show these errors...

CMHeartbeatThread … event=SummaryRegistration got unknown_state for summary at path=$SPLUNK_HOME/defaultdb/summary/65_B991D428-8CCC-4157-A1D4-DBF7597A94CA/E3DBF6A5-FB74-4203-B838-91301CACF7D7/splunk_app_netapp_admin_NS50c9fd6c09291287

CMHeartbeatThreat … event=SummaryRegistration got unknown_state for summary at path=$SPLUNK_HOME/var/lib/splunk/fota/datamodel_summary/4_29867C01-A6B5-4E43-963A-A76FFDD3C57C/36D9F313-4805-49E2-83B3-C721C8879E39/.DM_navail_NAVAIL.WAAS_Availability_Report_Events.rbsentinel
What is .rbsentinel ???

Re: [Cluster] What is .rbsentinel file ???

rbal_splunk — Fri, 15 Feb 2019 23:26:29 GMT

Splunk scan for summaries in the folders, and assume they’re summaries. however, splunk scan everything… so those lock files like .rbsentinel splunk get thrown off on but still scan
it's basically a no-op, but the logging report this

Re: [Cluster] What is .rbsentinel file ???

ddrillic — Sun, 17 Feb 2019 23:24:37 GMT

@jrodman said at What are the .sentinel files in $SPLUNK_DB for?

-- The .sentinel files are used on Splunk for win32/win64 as part of the locking strategy, to ensure exclusive access to buckets for certain types of modifications. Windows doesn't allow locking calls on directories with the same semantics as we desired.

They are mostly useless on a unix-based system, but in the interests of the index data format being able to traverse platforms are produced nonetheless.

Best practice is to move the .sentinel with the bucket it goes with.