Splunk Enterprise

Search Factor and Replication factory not met. Frozen=1

jfaldmomacu
Path Finder

I have started seeing this message often on my Indexer Cluster Master, when I view the Bucket Status page. 

bid=_internal~7404~4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX removed from peer=4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX, frozen=1

The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet.  I try to roll them but nothing happens. 

Does frozen=1 mean it is old data and since we don't have a frozen volume then I can delete these buckets? 
Any other suggestions on how to address this?

 

Labels (2)
0 Karma
1 Solution

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

View solution in original post

jdhunter
Path Finder

I'm seeing these messages as well now that I have upgraded to 8.1.3 (from 7.3.3)

0 Karma

jfaldmomacu
Path Finder

I found I needed to Resync the buckets and that fixed the issue.

Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...