https://community.splunk.com/t5/Splunk-Enterprise-Security/Bucket-Flap/m-p/486988#M8057 <P>Thank you: I will apply your fix but your explanation has already been pretty straightforwarded.</P> Tue, 28 Apr 2020 10:01:09 GMT adol83 2020-04-28T10:01:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Bucket-Flap/m-p/486986#M8055 <P>Hello,<BR /> I'm new here and I wanted some help for this issue.<BR /> My incident is getting many errors for a bucket replication that keeps flapping up/down. In the master dashboard I have the errors "search factor is not met" and "replication factor is not met" along with main page warnings like "msg='target doesn't have bucket now. ignoring' " and "making bucket serviceable, we have enough peers now " that suggests me it's flapping other than the up/down I see in the master dashboard.</P> <P>I have a little infrastructure with</P> <P>1 Master<BR /> 2 Indexers<BR /> 1 Search Head <BR /> 1 Heavy Forwarder</P> <P>My configuration on local (that should override the default server.conf) is fine having replication_factor=2 and search_factor=2 but it seems that no matter which change I apply the always stays up.<BR /> I tried to resync the bucket but actually I'm not even sure it did it. However, among my fix up tasks I have 2, 1 for replication factor and 1 for search factor </P> <P>For what concern search factor I have the following:</P> <P>fixup reason: unmet rf<BR /> current status: Missing enough suitable candidates to create searchable copy in order to meet replication policy. Missing={ default:1 } </P> <P>for what concern replication factor:</P> <P>fixup reason: unmet rf<BR /> current status: empty</P> <P>could you please let me know?</P> <P>I have some basic knowledge of administration and clustering by reading Splunk docs but I'm not sure I am really into yet.<BR /> splunk btool server list --debug <BR /> give me an output whereas replication_factor in local config is 2 and in default config is 3 but as far as I know local config in this case should override the default one.</P> <P>I'm stuck!</P> <P>Thank you in advance</P> Wed, 30 Sep 2020 05:13:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Bucket-Flap/m-p/486986#M8055 adol83 2020-09-30T05:13:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Bucket-Flap/m-p/486987#M8056 <P>Your issue is with the search_factor setting. It cannot be set to a value of 2 with a single search head. Search artifacts are stored on the search heads. Since you have only one search head, but a setting of 2, it is trying to replicate artifacts but nowhere to put them.</P> Mon, 27 Apr 2020 20:40:43 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Bucket-Flap/m-p/486987#M8056 codebuilder 2020-04-27T20:40:43Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Bucket-Flap/m-p/486988#M8057 <P>Thank you: I will apply your fix but your explanation has already been pretty straightforwarded.</P> Tue, 28 Apr 2020 10:01:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Bucket-Flap/m-p/486988#M8057 adol83 2020-04-28T10:01:09Z