topic Error while creating new index in Getting Data In

Error while creating new index

VijaySrrie — Mon, 08 Jun 2020 20:31:40 GMT

while trying to create a new index in search head getting error like Invalid apply cluster-bundle error="Bundle validation is in progress

Re: Error while creating new index

richgalloway — Tue, 10 Mar 2020 18:10:15 GMT

Did you create other indexes recently? If so, you must wait for that change to propagate to the rest of the search heads and indexers before creating another.

Re: Error while creating new index

ivanreis — Wed, 11 Mar 2020 05:08:36 GMT

Are you working on an indexer cluster environment? I am asking because this error message is related with a cluster master issue when deploying a new bundle configuration.
If so, I would rollback the current configuration running this command from CLI
./splunk rollback cluster-bundle
Or using web - https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/Updatepeerconfigurations#Rollback_the_configuration_bundle.

Restart the cluster master and Indexer cluster and try to redeploy the bundle.

please check this document for further information- > https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/Updatepeerconfigurations

Re: Error while creating new index

richgalloway — Wed, 11 Mar 2020 12:50:31 GMT

The question is tagged with splunk-cloud so no CLI is available.

Re: Error while creating new index

codebuilder — Mon, 16 Mar 2020 23:03:16 GMT

This can happen when validation fails (for multiple reasons). If the indexes.conf your are trying to deploy has not changed, you'll never get a new bundle created. One workaround that I use for this issue is to simply modify indexes.conf, and a extra "space" to the file (so that it is different from previous version) and re-validate, then push it out again.

Re: Error while creating new index

VijaySrrie — Fri, 10 Apr 2020 03:15:38 GMT

Hi All,

As this is cloud we do not have access to modify indexes.conf. Splunk vendor team has done the necessary changes and a rolling restart performed. Now we are able to see the new index created