Hi all,
I have faced a serious problem after upgrading indexers to 9.2.0.1! Occasionally, they stop data flow and sometimes are shown down on cluster master!
I analyzed the problem and it shows this error occasionally:
Search peer indexer-1 has the following message: The index processor has paused data flow. Too many tsidx files in idx=main bucket="/opt/SplunkData/db/defaultdb/hot_v1_13320" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised.
It worked smooth with same load in lower versions! I think this is a bug in new version or some more configuration is needed!
Finally, I rolled back to 9.1.3 and it now works perfectly.
I can confirm that the problem is fixed on version 9.2.1! I upgraded to version 9.2.1 and those indexers work perfectly without additional configuration!
Thanks
I can confirm that the problem is fixed on version 9.2.1! I upgraded to version 9.2.1 and those indexers work perfectly without additional configuration!
Thanks
It might be possible to tweak the indexer queue size and change the indexes.conf settings, as per this other community post:
According to the post it should be fixed in version 9.1, but perhaps something has made the issue resurface.
Thanks for your reply.
You are right! It is the same problem! But, it was said that it is fixed in 9.1 and I don't have any problem on 9.1.3! However, same bug has re-appeared on 9.2.0.1 again!
Indeed. You could try the workaround. Perhaps it still works.