Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
20 results
Sorted by:
10-15-2018
01:42 PM
...eplication factor from 3 to 2, once an indexer failure is something really rare.
My issue is that I set this config and restarted my Cluster Master, as requested, but the available disk space on my indexer...
02-15-2016
03:16 PM
...n the cluster master, what is the procedure to apply and remove the excess buckets?
Is it:
* server.conf change on cluster master
* restart splunk on cluster master to apply change
* Click "Remove...
12-20-2013
03:14 PM
2 Karma
...olicy; this may work for a 90 day retention policy, but not if it's like a year.)
Is there a way to manually trigger bucket replication between two peers and then remove the copies from the original n...
06-28-2016
05:10 PM
We are in Multi-site clustered environment with Site RF and SF= 3 and for different indexes, we see a number of buckets listed as excess buckets. Due to some reason, we are unable to remove these buckets
10-28-2015
08:53 AM
The splunk remove excess-buckets [index-name] command is not clearing all the excess buckets.
Have tried to clear from GUI and command line as well.
The buckets do not get cleared even after r...
07-19-2016
08:16 AM
...y | dbinspect index=* .
As noted here:
https://answers.splunk.com/answers/108941/deleting-a-bucket.html#answer-108942
hot/warm/cold buckets should not be removed while the server is running, b...
10-26-2017
06:49 AM
1 Karma
...owever, on the indexers, the size of $SPLUNK_DB/index1/colddb and $SPLUNK_DB/index1/db are 1.8TB and 2.1TB respectively.
Is this right?
Is there any way i can reduce the disk usage with the data r...
09-10-2018
12:25 PM
Hi,
I see some excess buckets in the bucket status tab in the indexer clustering page.
Is it safe to click remove button ? Does data become unavailable during the operation ?
Should the...
02-08-2019
01:49 AM
...earch_factor = 2
replication_factor = 2
But there are still 3 copies in the old cluster.
What can I do to remove the extra data from the cluster?
Splunk Enterprise
Version:
7.2.1
Build:
be11b2c46e23
02-20-2016
08:53 AM
Hello,
When trying to remove all excess buckets via the Cluster Master in a multisite indexer clustered environment, we don't see all excess buckets being removed, only some. Is it possible that the...
