Splunk Search

Why did request in search head fail to apply delete to some metadata?


Hello dear colleagues, has anyone encountered this error, I checked search.log for inconsistent metadata.

Help me decide.

Снимок экрана 2022-02-28 в 17.52.07.png

I have a request in SH, when I drive it I get this error

Labels (3)
0 Karma


Please share the query that produced the errors.  Have you checked search.log?  What did it say?

If this reply helps you, Karma would be appreciated.
0 Karma


what is related to the error is this

WARN  DownloadRemoteDataTransaction - Got status code: 204 ( No Content) from https://ip:8089/services/search/jobs/remote_splunk-sh_md_admin__admin__sysadmin__search1_md_DEE0755C...

03-01-2022 11:02:36.723 WARN  DownloadRemoteDataTransaction - Failed to download search.log from remote peer 'splunk-idx', uri='https://ip:8089', sid='remote_splunk-sh_md_admin__admin__sysadmin__search1_md_DEE0755CDB96'



0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...