Deployment Architecture

setting up indexer cluster

raghu0463
Explorer

Hi,

I was trying to setup indexer cluster, but in the console its showing the replication factor and search factor or not met ?

got the below error in Splunkd.log

Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=5610983424, elapsed_ms=1
01-26-2019 07:43:28.260 +0000 WARN CacheManager - Unable to evict enough data. Evicted size=0 instead of size=5610983424
01-26-2019 07:43:29.261 +0000 INFO CacheManager - Eviction requested, bytes_needed=5610983424 partition of path=/opt/splunk/var/lib/splunk/audit/db
01-26-2019 07:43:29.261 +0000 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

0 Karma

dkeck
Influencer

Hi

This sounds like your error

https://answers.splunk.com/answers/620357/unable-to-search-getting-this-error-unable-to-evic.html

Check the things mentioned in this answer

0 Karma

raghu0463
Explorer

How to decrease the free min disk space please ? at this path = /opt/splunk/var/lib/splunk/audit/db

0 Karma

dkeck
Influencer

HI, this is set in server.conf

 [diskUsage]
 minFreeSpace = <num>

https://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setlimitsondiskusage

or via CLI

splunk set minfreemb <number>
splunk restart
0 Karma

dkeck
Influencer

Please accept the answer if it helped 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...