Splunk 9.2.0.1 Bug

[banaie]

Hi all,

I have faced a serious problem after upgrading indexers to 9.2.0.1! Occasionally, they stop data flow and sometimes are shown down on cluster master!

I analyzed the problem and it shows this error occasionally:

Search peer indexer-1 has the following message: The index processor has paused data flow. Too many tsidx files in idx=main bucket="/opt/SplunkData/db/defaultdb/hot_v1_13320" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised. 

 It worked smooth with same load in lower versions! I think this is a bug in new version or some more configuration is needed!

Finally, I rolled back to 9.1.3 and it now works perfectly.

[banaie · Accepted solution]

I can confirm that the problem is fixed on version 9.2.1! I upgraded to version 9.2.1 and those indexers work perfectly without additional configuration!

Thanks

[marnall]

It might be possible to tweak the indexer queue size and change the indexes.conf settings, as per this other community post:

https://community.splunk.com/t5/Splunk-Enterprise/The-index-processor-has-paused-data-flow-How-to-op...

According to the post it should be fixed in version 9.1, but perhaps something has made the issue resurface.

[banaie]

@marnall 

Thanks for your reply. 

You are right! It is the same problem! But, it was said that it is fixed in 9.1 and I don't have any problem on 9.1.3! However, same bug has re-appeared on 9.2.0.1 again! 

[marnall]

Indeed. You could try the workaround. Perhaps it still works.