https://community.splunk.com/t5/Getting-Data-In/Indexer-fails-on-startup/m-p/450047#M78140 <P>When I try and restart one of my indexers after an OS upgrade I am seeing the following messages. My 2 other indexers are up and running. How do I fix this. I found one articale where they talk about fixing the offending buckets but don't say how and I am not positive this is the same issue</P> <P>09-06-2018 06:37:17.576 -0400 ERROR DatabaseDirectoryManager - idx=main bid=main~392~F18EA0F4-48F1-4D8C-8209-5B40F<BR /> 0B66E1E bucket=392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E Detected directory manually copied into its database, caus<BR /> ing id conflicts [path1='/opt/splunk/var/lib/splunk/defaultdb/db/rb_1535649215_1535592644_392_F18EA0F4-48F1-4D8C-8<BR /> 209-5B40F0B66E1E' path2='/opt/splunk/var/lib/splunk/defaultdb/db/392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E'].<BR /> 09-06-2018 06:37:17.579 -0400 ERROR IndexerService - Error intializing IndexerService: idx=main bid=main~392~F18EA<BR /> 0F4-48F1-4D8C-8209-5B40F0B66E1E bucket=392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E Detected directory manually copied<BR /> into its database, causing id conflicts [path1='/opt/splunk/var/lib/splunk/defaultdb/db/rb_1535649215_1535592644_<BR /> 392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E' path2='/opt/splunk/var/lib/splunk/defaultdb/db/392_F18EA0F4-48F1-4D8C-82<BR /> 09-5B40F0B66E1E'].</P> <P>09-06-2018 06:37:17.584 -0400 FATAL IndexerService - One or more indexes could not be initialized. Cannot disable<BR /> indexes on a clustering slave.</P> Tue, 29 Sep 2020 21:11:55 GMT a238574 2020-09-29T21:11:55Z https://community.splunk.com/t5/Getting-Data-In/Indexer-fails-on-startup/m-p/450047#M78140 <P>When I try and restart one of my indexers after an OS upgrade I am seeing the following messages. My 2 other indexers are up and running. How do I fix this. I found one articale where they talk about fixing the offending buckets but don't say how and I am not positive this is the same issue</P> <P>09-06-2018 06:37:17.576 -0400 ERROR DatabaseDirectoryManager - idx=main bid=main~392~F18EA0F4-48F1-4D8C-8209-5B40F<BR /> 0B66E1E bucket=392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E Detected directory manually copied into its database, caus<BR /> ing id conflicts [path1='/opt/splunk/var/lib/splunk/defaultdb/db/rb_1535649215_1535592644_392_F18EA0F4-48F1-4D8C-8<BR /> 209-5B40F0B66E1E' path2='/opt/splunk/var/lib/splunk/defaultdb/db/392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E'].<BR /> 09-06-2018 06:37:17.579 -0400 ERROR IndexerService - Error intializing IndexerService: idx=main bid=main~392~F18EA<BR /> 0F4-48F1-4D8C-8209-5B40F0B66E1E bucket=392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E Detected directory manually copied<BR /> into its database, causing id conflicts [path1='/opt/splunk/var/lib/splunk/defaultdb/db/rb_1535649215_1535592644_<BR /> 392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E' path2='/opt/splunk/var/lib/splunk/defaultdb/db/392_F18EA0F4-48F1-4D8C-82<BR /> 09-5B40F0B66E1E'].</P> <P>09-06-2018 06:37:17.584 -0400 FATAL IndexerService - One or more indexes could not be initialized. Cannot disable<BR /> indexes on a clustering slave.</P> Tue, 29 Sep 2020 21:11:55 GMT https://community.splunk.com/t5/Getting-Data-In/Indexer-fails-on-startup/m-p/450047#M78140 a238574 2020-09-29T21:11:55Z https://community.splunk.com/t5/Getting-Data-In/Indexer-fails-on-startup/m-p/450048#M78141 <P>Hi @a238574,</P> <P>Based on logs there is Bucket ID conflict in your <CODE>main</CODE> index.</P> <P>You have Bucket ID <CODE>392</CODE> at <CODE>/opt/splunk/var/lib/splunk/defaultdb/db/rb_1535649215_1535592644_392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E</CODE> and <CODE>/opt/splunk/var/lib/splunk/defaultdb/db/392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E</CODE> in same index which is causing issue here. The thing is bucket starting with <CODE>rb_</CODE> is a replicated bucket and should replicated from different indexer but here it looks like you have same <CODE>GUID - F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E</CODE> across different indexers. Each Indexer should have different <CODE>GUID</CODE> so first check across your indexer with duplicated GUID. </P> Thu, 06 Sep 2018 11:51:40 GMT https://community.splunk.com/t5/Getting-Data-In/Indexer-fails-on-startup/m-p/450048#M78141 harsmarvania57 2018-09-06T11:51:40Z