Deployment Architecture
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

What are the reasons for buckets with name duplicate-* in splunk indexer cluster?

renjith_nair
SplunkTrust
SplunkTrust

We have recently changed the index path for an indexer node to add additional disk and currently experiencing an issue with duplicate buckets created in indexer cluster.

Steps performed

  • Offline the node
  • Move the data from old directory to new directory
  • Changed the path in indexes.conf to point to the new directory
  • Started up node.

The hot an warm buckets are in one directory/path and cold buckets are on another path. Currently we have buckets with name duplicate-rb-* in colddb (only). Tried removing the duplicate bucket and restarted node, but it's still the same. How do we get rid of the duplicates since it's consuming considerable amount of space?

Configuration

multisite=true
site_replication_factor = origin:1,total:2
replication_factor = 2
Two nodes on each site.

Verified few buckets manually and the raw data seems to be same in original as well as in duplicate. So it does not seem to be an bucket id generation issue.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

The reason for the issue was a configuration conflict where thawed path and cold path was pointing to the same directory irrespective of not having any content under thawed path. Soft links have added more complication to resolution. Thought of mentioning it in case somebody faces the same issue.

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

The reason for the issue was a configuration conflict where thawed path and cold path was pointing to the same directory irrespective of not having any content under thawed path. Soft links have added more complication to resolution. Thought of mentioning it in case somebody faces the same issue.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!