topic Re: How can convert the replication factor raw log to searchable data in index cluster in Installation

How can convert the replication factor raw log to searchable data in index cluster

msplunk33 — Sun, 11 Oct 2020 04:30:34 GMT

How can convert the replication factor raw log to searchable data incase the searchable data is not available in a indexer. Is this a automated process by indexer or manual process.

Re: How can convert the replication factor raw log to searchable data in index cluster

isoutamo — Sun, 11 Oct 2020 08:05:46 GMT

this is automated process, which starts after CM has realized that one node is missing from cluster. Unfortunately I couldn’t found any good presentation of this. There are at least in some training materials where this was clearly presented.

r. Ismo

Re: How can convert the replication factor raw log to searchable data in index cluster

msplunk33 — Sun, 11 Oct 2020 16:53:39 GMT

@isoutamo Do you mean one node completely fail or just unresponsive. when CM start this process What is the process of restoring a comply failed node after a failure. How about the previous log this node was storing will it be automatically restored if we rejoin this node as a new fresh node with same disc structure. Do we need to manually copy the old log.

Re: How can convert the replication factor raw log to searchable data in index cluster

isoutamo — Mon, 12 Oct 2020 05:29:45 GMT

Here is described what and how bucket fixing has done when peers go offline.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Whathappenswhenaslavenodegoesdown

r. Ismo