Hi,
I have a cluster consisting of 2 indexers. At the weekend one of my indexers shut down unexpectedly and since then (6 days now) 20 of my 24 buckets are not fully searchable.
Looking at the Bucket Status page under the fixup tasks - Generation, there are entries for each bucket that has a problem like so.
payin~5~EF268AB0-A0AA-425A-B52F-0C1CD1542A76 payin Received shutdown notification from peer=EF268AB0-A0AA-425A-B52F-0C1CD1542A76 12/03/2016 06:01 Cannot pick primary as the bucket hasn't rolled yet.;
I have tried restarting the indexer that these messages refer to but that didn't make any difference.
Anyone got any ideas?
Thanks
Hi basher,
Whats the bucket status on Cluster Master's Dashboard ?
You should also read this, http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/CommandlinetoolsforusewithSupport...