Deployment Architecture
Highlighted

Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

SplunkTrust
SplunkTrust

Hello,

I have built a Splunk testing / staging environment on top of 6 VMs. Splunk version is 6.2.3 and us running on CentOS 6.6.
I have 1 Search Head, 1 Utilities Server (Cluster Master / Deployment Server) and 4 Indexers (Multi Site Cluster).

The cluster has come up and is showing all hosts within the management console.

Search factor is set to 2 and replication factor is set to 3.
The only indexes are _audit and _internal. Searchable data is fine 2/2 but replicated data is 2/3.
Bucket status is showing 8x fixup tasks - pending. I have rebooted the cluster master and peer nodes (rolling restart).

If I view the bucket statuses I get:

Missing enough suitable candidates to create a replicated copy in order to meet replication policy. Missing={ site2:1 }

Any help or advice would be appreciated.

0 Karma
Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

SplunkTrust
SplunkTrust

The trigger condition is showing:
"Removing peer "

0 Karma
Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

SplunkTrust
SplunkTrust

As it's a new build I just cleaned out the indexes and now the issue has gone away:
splunk stop
splunk clean eventdata -index _internal -f
splunk clean eventdata -index _audit -f
splunk start

View solution in original post

Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

Motivator

wiping all data isn't really a realistic answer

Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

Contributor

I downvoted this post because i cant remove all data to fix my data issue

Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

Explorer

I downvoted this post because wiping all data doesn't solve the problem

Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

SplunkTrust
SplunkTrust

I downvoted this post because this isn't a realistic answer and should very clearly state that all data in that index will be destroyed.

0 Karma
Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

Contributor

I downvoted this post because removed data to fix data issue is not a answer.

0 Karma
Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

Communicator

I downvoted this post because i downvoted this post because i can't remove all data to fix my data issue

0 Karma
Highlighted

Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?

Contributor

I downvoted this post because data loss.

0 Karma