Deployment Architecture

Bundle Replication: Can you help me with my problem replicating config (bundle) to search peer on search head?

sabaKhadivi
Path Finder

I have one search head, 1 Siem and 2 indexers which are managed by a cluster-master. I got this error on my search-head:

Bundle Replication: Problem replicating config (bundle) to search peer ' one of my indexer ip address :8089 ', HTTP response code 204 (HTTP/1.1 204 No Content)
and i find this error in my splunkd.log of the mentioned peer:

DistBundleRestHandler - There was a problem renaming: /archive/splunk/var/run/searchpeers/SearchHead URL- x.tmp -> /archive/splunk/var/run/searchpeers/SearchHead URL-y: File exists
10-07-2018 00:01:13.425 +0330 ERROR DistBundleRestHandler - Problem untarring file: /archive/splunk/var/run/searchpeers/SearchHead URL-y.bundle

how can I resolve this problem?

0 Karma

back2root
Path Finder
  1. Check if time is right on all systems. You should sync clocks with ntp
  2. Check if file permissions are fine
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...