topic Re: How to restore the corrupted buckets in Monitoring Splunk

HHow to restore the corrupted buckets

msplunk33 — Thu, 15 Oct 2020 00:17:01 GMT

I have a issue with one index in which the bucket is corrupted and I lost logs from this index for a period of time. How can I fix this.

Re: HHow to restore the corrupted buckets

richgalloway — Thu, 15 Oct 2020 12:38:44 GMT

Try running Splunk's fsck command. See https://docs.splunk.com/Documentation/Splunk/Latest/Troubleshooting/CommandlinetoolsforusewithSupport#fsck and https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Bucketissues

Re: How to restore the corrupted buckets

msplunk33 — Thu, 15 Oct 2020 23:05:39 GMT

@richgalloway

I have a clustered indexers in a multi site environment. DO I need to shutdown the full cluster to run the

fsck command?

Re: How to restore the corrupted buckets

richgalloway — Fri, 16 Oct 2020 12:47:45 GMT

You only need to stop the indexer on which the corrupt bucket resides.

Re: How to restore the corrupted buckets

msplunk33 — Fri, 16 Oct 2020 21:53:31 GMT

@richgalloway

If I shutdown one node alone can this case search factor and replication factor met failure? Will the data generated during the shutdown period will be replicated to this nodes after we bring it up?

Re: How to restore the corrupted buckets

richgalloway — Sun, 18 Oct 2020 21:52:13 GMT

Shutting down an indexer may affect the ability for Splunk for maintain the desired search and replication factors. It depends on your architecture and the specific RF/SF settings. It will only be temporary, though. Once the indexer comes back up the RF and SF will resolve themselves.

Data onboarded while the indexer is down will be stored on the other indexer(s) and will be replicated to the restarted node, if necessary.