Installation

Cluster Master - Bundle invalid.

Crashfry
Path Finder

Running into issues with the cluster master after the validation process locked up. Any bundle that is created - shows invalid when checking. Is there something i've missed in the steps here to get this functioning again?

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

The bundle validation is a 2 steps process :

  • the Cluster master (CM) generates the bundle from his folder and check locally its validity
  • then send the bundle for review to each indexers, and they all do validation with their local existing bundle.
  • the indexes respond with their validity check to the cluster-master
  • if any failed, the CM returns that the bundle is invalid. (a timeout or an older failed bundle still waiting may be a reason)

So check the _internal splunkd.log on all the indexers and the CM to figure who decided that the bundle was invalid and why.

here is a doc about validation
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurationbundleissues

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

The bundle validation is a 2 steps process :

  • the Cluster master (CM) generates the bundle from his folder and check locally its validity
  • then send the bundle for review to each indexers, and they all do validation with their local existing bundle.
  • the indexes respond with their validity check to the cluster-master
  • if any failed, the CM returns that the bundle is invalid. (a timeout or an older failed bundle still waiting may be a reason)

So check the _internal splunkd.log on all the indexers and the CM to figure who decided that the bundle was invalid and why.

here is a doc about validation
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurationbundleissues

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...