Is it "safe" to copy buckets across indexers when buckets get corrupt?

Ultra Champion

On our index cluster, certain buckets got corrupt on one indexer. Is it possible to copy a bucket from a healthy indexer over the corrupt one?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

(Answer to this old question)
Yes, possible as a workaround. In general, if you delete the corrupted bucket (splunk must be stopped, and remove the bucket and restart it again), Cluster Master should detect Replication factor is not met, and create a copy to a cluster peer.

In v6.5, there is action in fix-up bucket status page and select "remove/resync, etc"

If it is pre-v6.5, "remove_from_peer" REST call may be useful without stopping Splunk.
( ref: )

If that is failing, potentially somehow source bucket itself is corrupted. I would suggest to run;

splunk fsck repair --one-bucket --bucket-path=<bucket_path>

Hope this helps for people visiting this answer.

0 Karma