I'm in the middle of doing historical data migration form on-prem indexers to S3 in Splunk Cloud.
Some of the data is making it through, but I'm getting a ton of these type messages in splunkd.log on the on-prem indexers:
WARN S3Client - Error getting object name = <...GUID/receipt.json(0,-1,) to localPath = /opt/splunk/var/run/splunk/cachemanager/receipt-(some numbers.json>
Hello,
I guess you find the answer...
I got same when moving buckets from indexer to s3 without maintenance mode enabled.
Once finished, cluster rolling restart and a bootstraping of the indexers should do the trick.
Regards,
Ema