All Apps and Add-ons
Highlighted

Issues with reintegrating buckets after stopping/restarting instances AWS

New Member

Following a reboot of our SPLUNK instances in AWS, we have lost all data before, currently, I am having trouble reintegrating the bucket by build and some indexers are no longer operational.

Here is the message of the log to integrate a specific bucket and the HS warning.

==>

idx=firedalerts Path homePath='/opt/splunk/var/lib/splunk/firedalerts/db' (realpath '/opt/splunk/var/lib/splunk/firedalerts/db') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by homePath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=firedalerts Path coldPath='/opt/splunk/var/lib/splunk/firedalerts/colddb' (realpath '/opt/splunk/var/lib/splunk/firedalerts/colddb') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=os Path homePath='/opt/splunk/var/lib/splunk/os/db' (realpath '/opt/splunk/var/lib/splunk/os/db') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by homePath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=os Path coldPath='/opt/splunk/var/lib/splunk/os/colddb' (realpath '/opt/splunk/var/lib/splunk/os/colddb') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
Operating on: idx=purecloud bucket='/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525'
(subchild_41__SplunkOptimize)  splunk-optimize start: dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp mode=0 isfinal=true max_iteration=2147483647 min_src_count=2 lex_tpb=64
(subchild_41__SplunkOptimize)  optimize finished: files merged successfully, dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp, rc=0 (unsigned 0), errno=2
(subchild_41__SplunkOptimize)  optimize finished: less than 2 tsidx files in dir, dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp, rc=-30 (unsigned 226), errno=2
(subchild_41__SplunkOptimize)  exiting splunk-optimize process with rc=-30 (unsigned 226)


<==

Please for helping !

0 Karma