Splunk Enterprise

Search Factor and Replication factory not met. Frozen=1

jfaldmomacu
Path Finder

I have started seeing this message often on my Indexer Cluster Master, when I view the Bucket Status page. 

bid=_internal~7404~4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX removed from peer=4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX, frozen=1

The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet.  I try to roll them but nothing happens. 

Does frozen=1 mean it is old data and since we don't have a frozen volume then I can delete these buckets? 
Any other suggestions on how to address this?

 

Labels (2)
0 Karma
1 Solution

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

View solution in original post

jdhunter
Path Finder

I'm seeing these messages as well now that I have upgraded to 8.1.3 (from 7.3.3)

0 Karma

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...