Deployment Architecture

What are the reasons for buckets with name duplicate-* in splunk indexer cluster?

renjith_nair
SplunkTrust
SplunkTrust

We have recently changed the index path for an indexer node to add additional disk and currently experiencing an issue with duplicate buckets created in indexer cluster.

Steps performed

  • Offline the node
  • Move the data from old directory to new directory
  • Changed the path in indexes.conf to point to the new directory
  • Started up node.

The hot an warm buckets are in one directory/path and cold buckets are on another path. Currently we have buckets with name duplicate-rb-* in colddb (only). Tried removing the duplicate bucket and restarted node, but it's still the same. How do we get rid of the duplicates since it's consuming considerable amount of space?

Configuration

multisite=true
site_replication_factor = origin:1,total:2
replication_factor = 2
Two nodes on each site.

Verified few buckets manually and the raw data seems to be same in original as well as in duplicate. So it does not seem to be an bucket id generation issue.

Happy Splunking!
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

The reason for the issue was a configuration conflict where thawed path and cold path was pointing to the same directory irrespective of not having any content under thawed path. Soft links have added more complication to resolution. Thought of mentioning it in case somebody faces the same issue.

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

The reason for the issue was a configuration conflict where thawed path and cold path was pointing to the same directory irrespective of not having any content under thawed path. Soft links have added more complication to resolution. Thought of mentioning it in case somebody faces the same issue.

Happy Splunking!
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...