Splunk Enterprise

Search Factor and Replication factory not met. Frozen=1

jfaldmomacu
Path Finder

I have started seeing this message often on my Indexer Cluster Master, when I view the Bucket Status page. 

bid=_internal~7404~4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX removed from peer=4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX, frozen=1

The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet.  I try to roll them but nothing happens. 

Does frozen=1 mean it is old data and since we don't have a frozen volume then I can delete these buckets? 
Any other suggestions on how to address this?

 

Labels (2)
0 Karma
1 Solution

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

View solution in original post

jdhunter
Path Finder

I'm seeing these messages as well now that I have upgraded to 8.1.3 (from 7.3.3)

0 Karma

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...