Splunk Enterprise

Config validation failure reported in peer.

sgabriel1962
Explorer

Config validation failure reported in peer=usxzvrspidx1.usaccess.gsa.gov guid=62899FCC-C4E8-4A86-903D-C72234AE7F38. In index '_audit': Failed to create directory '/opt/splunk/var/lib/splunk/cold/audit/colddb' (File exists); .

I made a change to my my indexes:

[wineventlog]
homePath = volume:hotwarm/wineventlog/db
coldPath = volume:cold/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 0
maxWarmDBCount = 300
frozenTimePeriodInSecs = 33696000
repFactor = auto

[syslog]
homePath = volume:hotwarm/syslog/db
coldPath = volume:cold/syslog/colddb
thawedPath = $SPLUNK_DB/syslog/thaweddb
repFactor = auto
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 11059200
maxWarmDBCount = 4294967295
frozenTimePeriodInSecs = 33696000

Since this change  the indexers quit receiving data from their forwarders.   So I want to put the values back and Im getting this error when I want to apply the bundle change 

Need help on how to fix this

 

Labels (1)
0 Karma

KendallW
Contributor

Hi @sgabriel1962 ,  What changes did you make, and how did you deploy them? Did you deploy a bundle from your cluster manager?
Try running this on cluster manager:  ./bin/splunk validate cluster-bundle


0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...