Solved: Phantom : Warm-standby failover is not working as ... - Splunk Community

Splunk SOAR (f.k.a. Phantom)

Warm-standby failover is not working as the filesystem size of /opt/phantom/db is more than /tmp/. How to fix it?

1 Solution

Solution

Easiest fix increase space allocated to /tmp filesystem then problem solved( if possible).

on latest 4.8 version, can specify where to dump tmp db. also only restores tmp db if it's copied over.

View solution in original post

Solution

Easiest fix increase space allocated to /tmp filesystem then problem solved( if possible).

on latest 4.8 version, can specify where to dump tmp db. also only restores tmp db if it's copied over.

Get Updates on the Splunk Community!

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...