How can a search head and an indexer cluster be merged after the cluster has been run intentionally in a split brain setup for some time.
e.g. the connections between two locations of a multi site...
I'm seeing the error below under messages in my Splunk enterprise console:
Missing or malformed messages.conf stanza for TCPOUT:FORWARDING_BLOCKED_Indexer IP ADDress_default-autolb-group DC-Host N...
We have a multisiteindexer cluster running Splunk 6.2.7. with 40 indexers.
Many of the indexers have their data partitions over 90% full.
We are trying to clear up disk space inorder to avoid c...
We have noticed both failure of ingestion, and successful ingestion when the replication factor for an indexcluster has not been met.
What is the specific behaviour of Splunk when the indexing r...
...seems problematic -- assuming it is done via a CLI command and not by restarting the clustermasterinstance.
The SH was added to the indexcluster using the following command from the SH:
./s...
We have inindexcluster:
two node indexcluster
two sites (one index peer in each site)
We are seeing an issue whereby rolling restarts of our indexcluster is causing indexing issues o...
...ustomindexname/rebuild-metadata-and-manifests)
5) Performed rolling restart from ClusterMaster and all indexers went down.
6) After issue checked .bucketManifest file and found that "origin_site" header w...
...t a time. See Site-by-site upgrade for multisiteindexer clusters.
Perform the following steps:
Stop the master.
Stop all the peers and search heads.
When bringing down the p...