Splunk Enterprise

Config validation failure reported in peer.

sgabriel1962
Explorer

Config validation failure reported in peer=usxzvrspidx1.usaccess.gsa.gov guid=62899FCC-C4E8-4A86-903D-C72234AE7F38. In index '_audit': Failed to create directory '/opt/splunk/var/lib/splunk/cold/audit/colddb' (File exists); .

I made a change to my my indexes:

[wineventlog]
homePath = volume:hotwarm/wineventlog/db
coldPath = volume:cold/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 0
maxWarmDBCount = 300
frozenTimePeriodInSecs = 33696000
repFactor = auto

[syslog]
homePath = volume:hotwarm/syslog/db
coldPath = volume:cold/syslog/colddb
thawedPath = $SPLUNK_DB/syslog/thaweddb
repFactor = auto
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 11059200
maxWarmDBCount = 4294967295
frozenTimePeriodInSecs = 33696000

Since this change  the indexers quit receiving data from their forwarders.   So I want to put the values back and Im getting this error when I want to apply the bundle change 

Need help on how to fix this

 

Labels (1)
0 Karma

KendallW
Contributor

Hi @sgabriel1962 ,  What changes did you make, and how did you deploy them? Did you deploy a bundle from your cluster manager?
Try running this on cluster manager:  ./bin/splunk validate cluster-bundle


0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026  |  10:00AM PT / ...

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

Inside Splunk Agent Observability:Understanding Agent Behavior, Tokens & Costs Thursday, August 06, ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...