Deployment Architecture

Where to check the clock skew

vrmandadi
Builder

I have issues with clustering .I tried running the resync command but it says "Downloaded an old snapshot created 10018 seconds ago; Check for clock skew on this member or the captain; If no clock skew is found, check the captain for possible snapshot creation failures
"

Where can I see the clock skew and where can I change it

0 Karma

amitm05
Builder

Hi @vrmandadi

You can run this to check for time skew among your instances -

| rest /services/server/info | eval updated_t=round(strptime(updated, "%Y-%m-%dT%H:%M:%S%z"), 2) | eval delta=now()-updated_t | table serverName, updated, delta | convert ctime(updated_t)| rename updated as "Local Time on Server on Request" delta as "Offset - Time in Seconds"

And if you find some gap here, you might want to set your server clocks
Also check -
https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Troubleshootdistributedsearch

amitm05
Builder

Let me know by accepting the answer if it responds your query. Thanks

0 Karma

lmvmandadi
Engager

I checked the time but the offset-time in seconds did not show anything .But still the error persists

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...