Splunk Enterprise

cluster-merge-buckets command throwing exception of additional space

abhishekagg
Engager

Hi Team,
I have tried executing the cluster-merge-buckets command on Cluster Manager and got the following error / exception:

Command:

./splunk cluster-merge-buckets -index-name _audit -startdate 2020/01/01 -enddate 2024/01/24 -max-count 1000 -min-size 1 -max-total-size 1024


Output:

Using the following config: 

-max-count=1000 -min-size=1 -max-size=1000 -max-timespan=7776000

Dryrun has started. merge_txn_id=1706209703.24
[...] peer=IDX01 processStatus=Merge_Done totalBucketsToMerge=28 mergedBuckets=28 bucketsUnableToMerge=0 createdBuckets=1 sizeOfMergedBuckets=
868MB progress=100.0%
[...] peer=IDX02 processStatus=Merge_Done totalBucketsToMerge=23 mergedBuckets=23 bucketsUnableToMerge=0 createdBuckets=1 sizeOfMergedBuckets=
718MB progress=100.0%

progress=100.0% peers=2 completedPeers=2 failedPeers=0 totalBucketsToMerge=51 mergedBuckets=51 bucketsUnableToMerge=0 createdBuckets=2 totalSizeOfMergedBucket
s=1586MB
(Additional space required for localizing S2 buckets up to the equivalent of sizeOfMergedBuckets for each peer)
----------------------------------------------------------------------------------------------------------------------------------------

Have anyone experienced the same earlier or could help me with the resolutions.

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It looks to me like the dry run completed successfully.  There were no buckets that could not be merged and no failed peers.  Have you tried running with dryrun=false?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It looks to me like the dry run completed successfully.  There were no buckets that could not be merged and no failed peers.  Have you tried running with dryrun=false?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...