replication was unsuccessful. failed_because_REMOTE_CHKSUM_UNMATCHED

[sylim_splunk]

Bundle checksum match fails on Search Head hundreds of times per day, we are seeing the same local bundle failing to match the same remote bundle checksum across some indexers.

--- WARN message --
Unable to distribute to peer named mySplunk at uri https://10.1.1.2:8089 because replication was unsuccessful. replicationStatus Failed failure info: failed_because_REMOTE_CHKSUM_UNMATCHED: Remote checksum does not match: remote(mySplunk, 1168766487237572, 1497512449) != local(125317778217050120, 1497512449) Please verify connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available. See the Troubleshooting Manual for more information.

[sylim_splunk · Accepted solution]

This turned out to be a defect, of which fix is soon to be released - check with splunk support.

Workaround :
Restart the search-head which is issuing failed checksum warnings during searches. Saved jobs (ie. results from searches stored for further usage) that showed those warnings will not be repaired, they need to be re-ran.

Fixed versions :
6.3.11, 6.4.8, 6.5.5, 6.6.3, 7.0.0

[dflodstrom]

I'm seeing this in a 6.6.3 environment

[bnorthway_splun]

Which version has this fix?

[mbksplunk]

Encountered this issue today in our env as well. In which version is this being fixed ?