1 bucket is in pending state on RF

[NOORULAINE]

Hi 

1 bucket stuck at “fixup task pending” state with below error. I tried restarting Splunk, Re-sync and roll but its not working. Can anyone suggest the possible solution in order to troubleshoot the issue

Missing enough suitable candidates to create replicated copy in order to meet replication policy. Missing={ site3:1 }

[PickleRick]

The message says what your cluster is missing - an indexer located in site3 to which the bucket could be replicated.

[NOORULAINE]

Hi,

Could you please let me know how to resolve the issue

Thanks

[PickleRick]

It depends on your architecture and your config. How many indexers you have and in what sites are they? What is your siteRF/siteSF configuration?

[NOORULAINE]

We have total 3 indexers and below is the site configuration

Replication Factor ? origin:1, site1:1, site2:1, site3:1, total:3
Search Factor ? origin:1, total:2

Can you please help me with that

Thanks 

[PickleRick]

And each of your indexers is in different site? And all your indexers are online and OK?

(BTW, this seems a bit overly complicated; unless you're planning on some further expansion of your environment, you could perfectly well get away with a single-site setup).

[NOORULAINE]

yes all the indexers are up and running fine 

So what will be the possible solution in order to mitigate the above issue?

[PickleRick]

This requires more thorough debugging. You need to look into your splunkd.log on indexers and possibly on the CM and look for errors.