Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Lost data after indexers had to rebuild in an inde...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had to rebuild my two slave indexers, but the master is still intact. However, I lost all data prior to the rebuild. Does the master not maintain a copy of the data? If not, had I rebuilt one, and waited for data replication before rebuilding the second, would I have maintained the data?
Also, how can I determine how long replication from one indexer to another is taking?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.
The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.
If you don't have any backups....well, you're screwed. Sorry, dude.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.
The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.
If you don't have any backups....well, you're screwed. Sorry, dude.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fortunately this is not a production environment. So the loss of data is actually a good lesson learned for production. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Phew - I'm glad it's not prod! I was worried for ya!
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
