Archive

Splunk complains about "Data Durability" and "Data Searcheable" but I cannot identify the reason

afx
Contributor

Hi,
I have been through the monitoring console, the logs and tried the health report.
Still no clue.
The only thing I see is an error with _audit in the indexer clustering status where _audit is the only index that shows up as not fully searchable.
Of course searching in _audit works.

Any ideas what to do with this?

thx
afx

Tags (1)

jacobpevans
Motivator

Can you post the error messages in their entirety?

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

afx
Contributor

I see the following:
Data Durability

    Root Cause(s):
        Replication Factor is not met   
        Search Factor is not met    
    Last 50 related messages:
        09-16-2019 11:31:53.118 +0200 INFO CMMaster - event=commitGenerationFailure pendingGen=654 requesterReason=service failureReason='bucketNotCompletePrimality first unmet bid=_audit~92~BFA7B47D-C493-42FF-9EBF-73AFECFD0EF8'
        09-16-2019 11:26:53.758 +0200 INFO CMMaster - event=commitGenerationFailure pendingGen=654 requesterReason=service failureReason='bucketNotCompletePrimality first unmet bid=_audit~92~BFA7B47D-C493-42FF-9EBF-73AFECFD0EF8' 

and

Data Searchable

    Root Cause(s):
        All data is not searchable. Please ensure all the buckets have primary copies   
    Last 50 related messages:
        09-16-2019 11:31:53.118 +0200 INFO CMMaster - event=commitGenerationFailure pendingGen=654 requesterReason=service failureReason='bucketNotCompletePrimality first unmet bid=_audit~92~BFA7B47D-C493-42FF-9EBF-73AFECFD0EF8'
        09-16-2019 11:26:53.758 +0200 INFO CMMaster - event=commitGenerationFailure pendingGen=654 requesterReason=service 

thx
afx

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on