Deployment Architecture

When check-integrity reveals a bad bucket, do numbers for the bad slices get reported?

New Member

I'm doing research on Splunk. I don't have direct access the product. I saw in a Splunk-provided presentation that "a bad bucket result returns the bucket number and slice number for a changed slice/bucket". Is this true? Here's the presentation:
Note: apparently karma is needed to post links. The presentation was by Dhruva Bhagi, Sr. Software Engineer at Splunk. The presentation is titled "Data Integrity Control".

I'd like to confirm this behavior. The check-integrity command and a snippet of sample output would be fantastic.


0 Karma


Hello gary,

Yes it does tell you which slice is wrong with this kind of message:

Integrity check failed for bucket with path=/opt/splunk/XXXXXXXX/index/db/rb_1480438183_1478748435_95_D6AXXXXXXXXX, Reason=Hash of journal slice# 45718 did not match the expected value in l1Hashes_95_D6AXXXXXXXXX.dat

I haven't yet tried to understand which event inside the bucket is wrong based on the slice number and the slices size.

In our case we have an indexer cluster, when this message pops we replace the bucket (in this exemple a replicated bucket) with its copy available on another cluster node.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...