Splunk Enterprise

Config validation failure reported in peer.

sgabriel1962
Explorer

Config validation failure reported in peer=usxzvrspidx1.usaccess.gsa.gov guid=62899FCC-C4E8-4A86-903D-C72234AE7F38. In index '_audit': Failed to create directory '/opt/splunk/var/lib/splunk/cold/audit/colddb' (File exists); .

I made a change to my my indexes:

[wineventlog]
homePath = volume:hotwarm/wineventlog/db
coldPath = volume:cold/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 0
maxWarmDBCount = 300
frozenTimePeriodInSecs = 33696000
repFactor = auto

[syslog]
homePath = volume:hotwarm/syslog/db
coldPath = volume:cold/syslog/colddb
thawedPath = $SPLUNK_DB/syslog/thaweddb
repFactor = auto
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 11059200
maxWarmDBCount = 4294967295
frozenTimePeriodInSecs = 33696000

Since this change  the indexers quit receiving data from their forwarders.   So I want to put the values back and Im getting this error when I want to apply the bundle change 

Need help on how to fix this

 

Labels (1)
0 Karma

KendallW
Contributor

Hi @sgabriel1962 ,  What changes did you make, and how did you deploy them? Did you deploy a bundle from your cluster manager?
Try running this on cluster manager:  ./bin/splunk validate cluster-bundle


0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...