Splunk Enterprise

Config validation failure reported in peer.

sgabriel1962
Explorer

Config validation failure reported in peer=usxzvrspidx1.usaccess.gsa.gov guid=62899FCC-C4E8-4A86-903D-C72234AE7F38. In index '_audit': Failed to create directory '/opt/splunk/var/lib/splunk/cold/audit/colddb' (File exists); .

I made a change to my my indexes:

[wineventlog]
homePath = volume:hotwarm/wineventlog/db
coldPath = volume:cold/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 0
maxWarmDBCount = 300
frozenTimePeriodInSecs = 33696000
repFactor = auto

[syslog]
homePath = volume:hotwarm/syslog/db
coldPath = volume:cold/syslog/colddb
thawedPath = $SPLUNK_DB/syslog/thaweddb
repFactor = auto
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 11059200
maxWarmDBCount = 4294967295
frozenTimePeriodInSecs = 33696000

Since this change  the indexers quit receiving data from their forwarders.   So I want to put the values back and Im getting this error when I want to apply the bundle change 

Need help on how to fix this

 

Labels (1)
0 Karma

KendallW
Contributor

Hi @sgabriel1962 ,  What changes did you make, and how did you deploy them? Did you deploy a bundle from your cluster manager?
Try running this on cluster manager:  ./bin/splunk validate cluster-bundle


0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...