Deployment Architecture

Bundle action - defining new index fails due to ileagal value of repFactor (auto)

piotrgalas
Explorer

Splunk 7.2 with cluster of 2 indexers.

 

I want to push indexes definitions to peers from master node and the bundle action fails stating that "Auto" is illegal value for repFactor and that the default value is "0".  I want them to replicate so "0" is not an option based on the documentation.  Bundle action is unsuccessful. What could be the reason for this error?

Both peers are up, no errors on the Master Indexer Clustering dashboard.

 

Content of the Master Node indexes.conf in the /opt/splunk/etc/master-apss/_cluster/local/

 

[log_windows]
repFactor = Auto
enableDataIntegrityControl = 0
enableTsidxReduction = 0
maxTotalDataSizeMB = 512000
coldPath = $SPLUNK_DB/log_windows/colddb
homePath = $SPLUNK_DB/log_windows/db
thawedPath = $SPLUNK_DB/log_windows/thaweddb

[pg_test]
repFactor = Auto
enableDataIntegrityControl = 0
enableTsidxReduction = 0
maxTotalDataSizeMB = 512000
coldPath = $SPLUNK_DB/pg_test_kiwi/colddb
homePath = $SPLUNK_DB/pg_test_kiwi/db
thawedPath = $SPLUNK_DB/pg_test_kiwi/thaweddb

 

Errors:

 

Config validation failure reported in peer=sanitized_indexer1 guid=(sanitized_guid_1). stanza=pg_test parameter=repFactor Value supplied='Auto' is illegal; default='0'; stanza=log_windows parameter=repFactor Value supplied='Auto' is illegal; default='0';

Config validation failure reported in peer=sanitized_indexer2 guid=(sanitized_guid_2). stanza=pg_test parameter=repFactor Value supplied='Auto' is illegal; default='0'; stanza=log_windows parameter=repFactor Value supplied='Auto' is illegal; default='0';

 

 

 

 

 

Labels (1)
0 Karma
1 Solution

piotrgalas
Explorer

OK. Thanks to Splunk Support (thanks Guys for fast and swift response) I learned what is the issue.

Correct:
repFactor = auto
Incorrect:
repFactor = Auto

It is case sensitive!

View solution in original post

0 Karma

piotrgalas
Explorer

OK. Thanks to Splunk Support (thanks Guys for fast and swift response) I learned what is the issue.

Correct:
repFactor = auto
Incorrect:
repFactor = Auto

It is case sensitive!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...