All Apps and Add-ons

Issues with reintegrating buckets after stopping/restarting instances AWS

malickattitude
New Member

Following a reboot of our SPLUNK instances in AWS, we have lost all data before, currently, I am having trouble reintegrating the bucket by build and some indexers are no longer operational.

Here is the message of the log to integrate a specific bucket and the HS warning.

==>

idx=firedalerts Path homePath='/opt/splunk/var/lib/splunk/firedalerts/db' (realpath '/opt/splunk/var/lib/splunk/firedalerts/db') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by homePath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=firedalerts Path coldPath='/opt/splunk/var/lib/splunk/firedalerts/colddb' (realpath '/opt/splunk/var/lib/splunk/firedalerts/colddb') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=os Path homePath='/opt/splunk/var/lib/splunk/os/db' (realpath '/opt/splunk/var/lib/splunk/os/db') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by homePath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=os Path coldPath='/opt/splunk/var/lib/splunk/os/colddb' (realpath '/opt/splunk/var/lib/splunk/os/colddb') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
Operating on: idx=purecloud bucket='/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525'
(subchild_41__SplunkOptimize)  splunk-optimize start: dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp mode=0 isfinal=true max_iteration=2147483647 min_src_count=2 lex_tpb=64
(subchild_41__SplunkOptimize)  optimize finished: files merged successfully, dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp, rc=0 (unsigned 0), errno=2
(subchild_41__SplunkOptimize)  optimize finished: less than 2 tsidx files in dir, dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp, rc=-30 (unsigned 226), errno=2
(subchild_41__SplunkOptimize)  exiting splunk-optimize process with rc=-30 (unsigned 226)


<==

Please for helping !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...