Whats the best process for remediating issues related to buckets not searchable

[tkw03]

Hello

We have many messages similar to:

Search peer thisIndexer05 has the following message: Failed to make bucket = some_windows_data~1234~4BAD1-0710-123F-9514-21C631A95232 searchable, retry count = 7106.

This has been happening for quite a while now. The indexer cluster is constantly working through fixup tasks and I assume its mostly related to resources on the hosts(from the research I've done) but I am curious to what else may cause this.

Is there a way to fix these buckets or is the only remedy to remove them?

Thanks for the thoughts.

[skalliger]

Did you try a restart of the Cluster Master already?

Skalli

[tkw03]

I have, it usually helps some but the issue never really goes away. We just did an upgrade and I was hoping the issue was more version related than something else but it seems its not version related.

[skalliger]

So if an upgrade didn't help (what verison are you at?) you might actually have corrupt buckets. You can try to follow this with caution: https://wiki.splunk.com/Community:PostCrashFsckRepair

Skalli

[tkw03]

We went from 7.0.3 to 7.1.8. and we will go to 7.3.1 when it comes out. Our sales/CSM didn't want us on 7.2.(anything) due to memory leak possibilities.
Really I think this comes back to resources, whether indexer of cluster master I am not sure