HHow to restore the corrupted buckets

[msplunk33]

I have a  issue with one index in which the bucket is corrupted and I lost logs from this index for a period of time. How can I fix this.

[richgalloway]

Try running Splunk's fsck command.  See https://docs.splunk.com/Documentation/Splunk/Latest/Troubleshooting/CommandlinetoolsforusewithSuppor... and https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Bucketissues

[msplunk33]

@richgalloway 

I have a clustered indexers in a multi site environment. DO I need to shutdown the full cluster to run the  

fsck command?

[richgalloway]

You only need to stop the indexer on which the corrupt bucket resides.

[msplunk33]

@richgalloway 

If I shutdown one node alone can this case  search factor and replication factor met failure? Will the data generated during the shutdown period will be replicated to this nodes after we bring it up?

[richgalloway]

Shutting down an indexer may affect the ability for Splunk for maintain the desired search and replication factors.  It depends on your architecture and the specific RF/SF settings.  It will only be temporary, though.  Once the indexer comes back up the RF and SF will resolve themselves.

Data onboarded while the indexer is down will be stored on the other indexer(s) and will be replicated to the restarted node, if necessary.