- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
6.1.3 issue with mounted Bundles
Following the upgrade from 6.1.1 to 6.1.3, we found that mounted bundles were having issues (configured using http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuremountedbundles). Our search head and indexers could not communicate to each other, with log entries like the following:
Search head:
08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - Unable to upload bundle to peer named splunk-indexerserver with uri=blah:8089.
08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - bundle size=1141MB, path=/opt/splunk/var/run/splunk-searchheadserver-1408027681.bundle, is too large for replication, max_size=1024MB. Check for any large unwanted files in $SPLUNK_HOME/etc/
Indexer:
08-14-2014 14:33:26.499 +0000 ERROR LMTracker - failed to send rows, reason='Unable to connect to remote peer: splunk-searchheadserver:8089 rc=2'
[will add answer separately]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
With 6.1.1, we didn't have "shareBundles=false" set in the local distsearch.conf. With the upgrade to 6.1.3, the default distsearch.conf file adds "shareBundles=true" which was the problem. When we added "shareBundles=false" to our local conf file, it fixed the issue.
