i am deploy new search head cluster, the deployment went successful but when i check the splunkd.log i fount one strange warning 04-08-2017 03:46:21.294 +0000 WARN ConfReplicationBookmark - serializeToJson: tried to serialize an empty bookmark
04-08-2017 03:46:21.294 +0000 WARN SHCHouseKeepingThread - writeSHCStateToStateStore: failed to serialize the bookmark
i am curious to know about this. what does it exactly means and is this a harmful warning?
do i face issues with this warning?
It indicates this Splunk instance could not understand SHC node status. I suspect you cannot see SHC status (splunk show shcsluter-status) in this node when the message was generated. I also suspect your conf replication is failing.
In that case, you might need to run destructive resync command to resolve the issue. You should make a backup of etc directory before running the command.
You said a new search head cluster. Are those Search head instances new ? If so, do you have three or more search heads? Please make sure you meet requirement to deploy a new SHC.