Knowledge Management

6.1.3 issue with mounted Bundles

michael_herbert
Explorer

Following the upgrade from 6.1.1 to 6.1.3, we found that mounted bundles were having issues (configured using http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuremountedbundles). Our search head and indexers could not communicate to each other, with log entries like the following:

Search head:

08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - Unable to upload bundle to peer named splunk-indexerserver with uri=blah:8089.
08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - bundle size=1141MB, path=/opt/splunk/var/run/splunk-searchheadserver-1408027681.bundle, is too large for replication, max_size=1024MB. Check for any large unwanted files in $SPLUNK_HOME/etc/

Indexer:

08-14-2014 14:33:26.499 +0000 ERROR LMTracker - failed to send rows, reason='Unable to connect to remote peer: splunk-searchheadserver:8089 rc=2'

[will add answer separately]

0 Karma

michael_herbert
Explorer

With 6.1.1, we didn't have "shareBundles=false" set in the local distsearch.conf. With the upgrade to 6.1.3, the default distsearch.conf file adds "shareBundles=true" which was the problem. When we added "shareBundles=false" to our local conf file, it fixed the issue.

Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...