Splunk Enterprise

DistributedBundleReplicationManager response code 400 (bad request)


I've been noticing some bundle distribution errors recently on one of my search heads. This search head is part of a 3 server search head cluster connecting to an indexer cluster. The message I am seeing is this:



06-30-2020 08:04:57.184 -0400 ERROR DistributedBundleReplicationManager - HTTP response code 400 (HTTP/1.1 400 Bad Request). Error applying delta=/opt/splunk/var/run/searchpeers/CD224AB5-4AD5-4680-BA13-01234645B8B6-1593518595-1593518680.delta, searchHead=CD224AB5-4AD5-4680-BA13-01234645B8B6, prevTime=1593518595, prevChksum=730910445532009996, curTime=1593518680, curChksum=3452252417076391070: Error copying /opt/splunk/var/run/searchpeers/CD224AB5-4AD5-4680-BA13-01234645B8B6-1593518595/indexing_tokens to /opt/splunk/var/run/searchpeers/CD224AB5-4AD5-4680-BA13-01234645B8B6-1593518680.2346fcb2e8de1493.tmp/indexing_tokens. 1 errors occurred. Description for first 1: [{operation:"stat'ing source directory", error:"No suc... (message truncated, search splunkd.log for "distribution_error" to see it in full).




I haven't had much luck finding anything on this on Answers or just searching for the issue. I've gone to the splunkd.log to search for this message but it actually shows truncated at the source, so there isn't "seeing it in full" there. May need to turn up logging level for it. Just wanted to see if anyone had any thoughts or have run into this before?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...