Splunk Enterprise

Search Factor and Replication factory not met. Frozen=1

jfaldmomacu
Path Finder

I have started seeing this message often on my Indexer Cluster Master, when I view the Bucket Status page. 

bid=_internal~7404~4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX removed from peer=4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX, frozen=1

The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet.  I try to roll them but nothing happens. 

Does frozen=1 mean it is old data and since we don't have a frozen volume then I can delete these buckets? 
Any other suggestions on how to address this?

 

Labels (2)
0 Karma
1 Solution

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

View solution in original post

jdhunter
Path Finder

I'm seeing these messages as well now that I have upgraded to 8.1.3 (from 7.3.3)

0 Karma

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...