Splunk Enterprise

Config validation failure reported in peer.

sgabriel1962
Explorer

Config validation failure reported in peer=usxzvrspidx1.usaccess.gsa.gov guid=62899FCC-C4E8-4A86-903D-C72234AE7F38. In index '_audit': Failed to create directory '/opt/splunk/var/lib/splunk/cold/audit/colddb' (File exists); .

I made a change to my my indexes:

[wineventlog]
homePath = volume:hotwarm/wineventlog/db
coldPath = volume:cold/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 0
maxWarmDBCount = 300
frozenTimePeriodInSecs = 33696000
repFactor = auto

[syslog]
homePath = volume:hotwarm/syslog/db
coldPath = volume:cold/syslog/colddb
thawedPath = $SPLUNK_DB/syslog/thaweddb
repFactor = auto
maxDataSize = auto_high_volume
coldPath.maxDataSizeMB = 11059200
maxWarmDBCount = 4294967295
frozenTimePeriodInSecs = 33696000

Since this change  the indexers quit receiving data from their forwarders.   So I want to put the values back and Im getting this error when I want to apply the bundle change 

Need help on how to fix this

 

Labels (1)
0 Karma

KendallW
Contributor

Hi @sgabriel1962 ,  What changes did you make, and how did you deploy them? Did you deploy a bundle from your cluster manager?
Try running this on cluster manager:  ./bin/splunk validate cluster-bundle


0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...