Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Failed to make bucket error
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have a cluster of indexers and a couple of SH to run my searches and recently i've been getting the following error from the SH:
Search peer INDEXER1 has the following message: Failed to make bucket = _internal~179~5EDAD0F8-8979-415D-BBB0-72E968D15EF8 searchable, retry count = 104.
Any idea how I can get rid of that ? I've tried deleting the bucket but nothing happens.
Regards,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can remove the bucket by hitting the bucket's remove_all endpoint on the master.
curl -k -u USER:LOGIN (https://) master_uri:mgmt_port/services/cluster/master/buckets/BUCKET_ID/remove_all -X POST
Otherwise if you're on 5.0.x, I'd freeze the bucket and it should leave you alone.
curl -k -u USER:LOGIN (https://) master_uri:mgmt_port/services/cluster/master/buckets/BUCKET_ID/freeze -X POST
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can remove the bucket by hitting the bucket's remove_all endpoint on the master.
curl -k -u USER:LOGIN (https://) master_uri:mgmt_port/services/cluster/master/buckets/BUCKET_ID/remove_all -X POST
Otherwise if you're on 5.0.x, I'd freeze the bucket and it should leave you alone.
curl -k -u USER:LOGIN (https://) master_uri:mgmt_port/services/cluster/master/buckets/BUCKET_ID/freeze -X POST
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What output should i get ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For Bucket_ID I use : _internal~179~5EDAD0F8-8979-415D-BBB0-72E968D15EF8 ?
Your Guide to Splunk Digital Experience Monitoring
Data Management Digest – November 2025
Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA
