...aking the time the search was running in, I got the epoch time and figured-out whatbucket was involved. I then used 'splunk rebuild' to rebuild the bucket (with splunkd stopped). Here is the r...
Just helped Support with this and want to document the results...
Let's say that I've indexed an S3 bucket, and realized that my line breakers were wrong and I need to reindex... well, I've got a...
...bsp; The cluster master will create a new replicate bucket. I need your inputs when prefix is: "db_", whatdoes it stand for and what all actions to take for it? Secondly, I also observed bucket p...
I have Clustered Spunk environment (also called as bucket replication) with
--One Cluster Master
--Five cluster Peers
--Search Head.
One of our Cluster Peer ran out of Disk Space for p...
Hello there,
We faced an issue with our Indexer Cluster and I am trying to understand what happened.
I see these messages :
07-25-2018 11:51:02.387 +0200 WARN CMMaster - event=r...
Hello fellow Splunkers,
I am trying to get to the bottom of issue I am having on an index cluster, specifically around hot buckets rolling before they should. I have read all of the docs around t...
...howing as Index Processor>Bucketswith root cause "The percentage of small buckets (71%) created over the last hour is high and exceeded the red thresholds (50%) for index=os, and possibly more indexes, o...
....
The backup guidelines state "hot bucket - Currently written to; non-incrementally changing; do not back this up." So, whatI'm trying to dois tune indexing policy to insure we move from h...
When you specify a coldToFrozenScript in indexes.conf, whatis responsible for deleting the cold bucket from the indexer's disc? (eg, is it your script, or does Splunk delete it once your script h...
...inimum free disk space (512000MB) reached for /opt/splunk/var/run/splunk/dispatch. 3/11/2021, 1:30:00 AM No matter whatIdo to make extra room, I keep getting the warnings. On each idx the s...