Deployment Architecture

Where to check the clock skew

Builder

I have issues with clustering .I tried running the resync command but it says "Downloaded an old snapshot created 10018 seconds ago; Check for clock skew on this member or the captain; If no clock skew is found, check the captain for possible snapshot creation failures
"

Where can I see the clock skew and where can I change it

0 Karma

Builder

Hi @vrmandadi

You can run this to check for time skew among your instances -

| rest /services/server/info | eval updated_t=round(strptime(updated, "%Y-%m-%dT%H:%M:%S%z"), 2) | eval delta=now()-updated_t | table serverName, updated, delta | convert ctime(updated_t)| rename updated as "Local Time on Server on Request" delta as "Offset - Time in Seconds"

And if you find some gap here, you might want to set your server clocks
Also check -
https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Troubleshootdistributedsearch

Builder

Let me know by accepting the answer if it responds your query. Thanks

0 Karma

Engager

I checked the time but the offset-time in seconds did not show anything .But still the error persists

0 Karma