https://community.splunk.com/t5/Installation/Cluster-Master-Bundle-invalid/m-p/432258#M8724 <P>The bundle validation is a 2 steps process :</P> <UL> <LI>the Cluster master (CM) generates the bundle from his folder and check locally its validity</LI> <LI>then send the bundle for review to each indexers, and they all do validation with their local existing bundle.</LI> <LI>the indexes respond with their validity check to the cluster-master</LI> <LI>if any failed, the CM returns that the bundle is invalid. (a timeout or an older failed bundle still waiting may be a reason)</LI> </UL> <P>So check the _internal splunkd.log on all the indexers and the CM to figure who decided that the bundle was invalid and why.</P> <P>here is a doc about validation<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurationbundleissues">https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurationbundleissues</A></P> Thu, 14 Mar 2019 23:47:03 GMT yannK 2019-03-14T23:47:03Z https://community.splunk.com/t5/Installation/Cluster-Master-Bundle-invalid/m-p/432257#M8723 <P>Running into issues with the cluster master after the validation process locked up. Any bundle that is created - shows invalid when checking. Is there something i've missed in the steps here to get this functioning again? </P> Thu, 14 Mar 2019 15:24:32 GMT https://community.splunk.com/t5/Installation/Cluster-Master-Bundle-invalid/m-p/432257#M8723 Crashfry 2019-03-14T15:24:32Z https://community.splunk.com/t5/Installation/Cluster-Master-Bundle-invalid/m-p/432258#M8724 <P>The bundle validation is a 2 steps process :</P> <UL> <LI>the Cluster master (CM) generates the bundle from his folder and check locally its validity</LI> <LI>then send the bundle for review to each indexers, and they all do validation with their local existing bundle.</LI> <LI>the indexes respond with their validity check to the cluster-master</LI> <LI>if any failed, the CM returns that the bundle is invalid. (a timeout or an older failed bundle still waiting may be a reason)</LI> </UL> <P>So check the _internal splunkd.log on all the indexers and the CM to figure who decided that the bundle was invalid and why.</P> <P>here is a doc about validation<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurationbundleissues">https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurationbundleissues</A></P> Thu, 14 Mar 2019 23:47:03 GMT https://community.splunk.com/t5/Installation/Cluster-Master-Bundle-invalid/m-p/432258#M8724 yannK 2019-03-14T23:47:03Z