Monitoring Splunk

HHow to restore the corrupted buckets

msplunk33
Path Finder

I have a  issue with one index in which the bucket is corrupted and I lost logs from this index for a period of time. How can I fix this.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
0 Karma

msplunk33
Path Finder

@richgalloway 

I have a clustered indexers in a multi site environment. DO I need to shutdown the full cluster to run the  

fsck command?

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You only need to stop the indexer on which the corrupt bucket resides.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

msplunk33
Path Finder

@richgalloway 

 

If I shutdown one node alone can this case  search factor and replication factor met failure? Will the data generated during the shutdown period will be replicated to this nodes after we bring it up?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Shutting down an indexer may affect the ability for Splunk for maintain the desired search and replication factors.  It depends on your architecture and the specific RF/SF settings.  It will only be temporary, though.  Once the indexer comes back up the RF and SF will resolve themselves.

Data onboarded while the indexer is down will be stored on the other indexer(s) and will be replicated to the restarted node, if necessary.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.