I have 3 indexer in cluster and data is being stored in the NAS server. and for one server data is stored in cold logs on a mounted storage.
I have copied the data from NAS to 2 server , the one with mounted point is giving me a duplicate error and I am not able to see data copied in the /opt/splunk/var/lib/splunk/accessdb/thaweddb/ is marked as diabled due to conflict.
I have tried multiple commands to rebuild the Splunk db in all the indexers. and I am getting error as attached screenshots
Note:The bucket id cannot conflict with any other bucket in the index. This example assumes that the bucket id '1001' is unique for the index. If it isn't, choose some other, non-conflicting bucket ID.
2.Execute thesplunk rebuildcommand on the archive bucket to rebuild the indexes and associated files: