Cluster Master - Bundle invalid.

[Crashfry]

Running into issues with the cluster master after the validation process locked up. Any bundle that is created - shows invalid when checking. Is there something i've missed in the steps here to get this functioning again?

[yannK · Accepted solution]

The bundle validation is a 2 steps process :

• the Cluster master (CM) generates the bundle from his folder and check locally its validity
• then send the bundle for review to each indexers, and they all do validation with their local existing bundle.
• the indexes respond with their validity check to the cluster-master
• if any failed, the CM returns that the bundle is invalid. (a timeout or an older failed bundle still waiting may be a reason)

So check the _internal splunkd.log on all the indexers and the CM to figure who decided that the bundle was invalid and why.

here is a doc about validation
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurationbundleissues