Deployment Architecture
Highlighted

Failed to make bucket error

SplunkTrust
SplunkTrust

Hello,

I have a cluster of indexers and a couple of SH to run my searches and recently i've been getting the following error from the SH:

Search peer INDEXER1 has the following message: Failed to make bucket = _internal~179~5EDAD0F8-8979-415D-BBB0-72E968D15EF8 searchable, retry count = 104.

Any idea how I can get rid of that ? I've tried deleting the bucket but nothing happens.

Regards,
David

0 Karma
Highlighted

Re: Failed to make bucket error

Engager

You can remove the bucket by hitting the bucket's remove_all endpoint on the master.

curl -k -u USER:LOGIN (https://) masteruri:mgmtport/services/cluster/master/buckets/BUCKETID/removeall -X POST

Otherwise if you're on 5.0.x, I'd freeze the bucket and it should leave you alone.

curl -k -u USER:LOGIN (https://) masteruri:mgmtport/services/cluster/master/buckets/BUCKET_ID/freeze -X POST

Software Testing Training in Chennai

View solution in original post

Highlighted

Re: Failed to make bucket error

SplunkTrust
SplunkTrust

For BucketID I use : `internal~179~5EDAD0F8-8979-415D-BBB0-72E968D15EF8` ?

0 Karma
Highlighted

Re: Failed to make bucket error

SplunkTrust
SplunkTrust

What output should i get ?

0 Karma