Deployment Architecture

Indexer Clustering Search Factor and Replication Factor not Met for Streaming Buckets

sat94541
Communicator

It is common to see that one or two buckets may not be meeting the Search Factor, although the data from the respective buckets will be searchable.

Many times these buckets are hot buckets, which mean these buckets will not meet the Search Factor unless the bucket is rolled from hot to warm. When you view these buckets using the Bucket REST endpoint using the URL below, the bucket will show status of 'StreamingSource' or 'StreamingTarget'

Bucket REST endpoint:
https://<CLUSTER_MASTER_URI>:<CLUSTER_MASTER_PORT>/services/cluster/master/buckets/<BUCKET_ID>

How to address such a situation?

0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Run the following curl command on the index where the bucket needs to be fixed.

HOST is the StreamingSource server name, PORT being 8089, YOUR_INDEX is the index needing to roll

 curl -k -u admin:changeme https://HOST:PORT/services/data/indexes/YOUR_INDEX/roll-hot-buckets -X POST

example of _audit something like

 curl -k -u admin:PASSWORD https://idx2:8089/services/data/indexes/_audit/roll-hot-buckets -X POST

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Run the following curl command on the index where the bucket needs to be fixed.

HOST is the StreamingSource server name, PORT being 8089, YOUR_INDEX is the index needing to roll

 curl -k -u admin:changeme https://HOST:PORT/services/data/indexes/YOUR_INDEX/roll-hot-buckets -X POST

example of _audit something like

 curl -k -u admin:PASSWORD https://idx2:8089/services/data/indexes/_audit/roll-hot-buckets -X POST
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...