Any luck? I'm having a similar issue on a search peer but only for a specific index and a specific date range that includes 1 particular day. ... View more

One scenario where I wanted to avoid re-indexing data was with our DR or backup intermediate forwarder. The backup intermediate forwarder has splunk disabled until needed in a disaster recovery scenario. All the inputs, (syslog archives, and NFS mounted filesystems with aggregated logs) on the backup intermediate forwarder are the same as the inputs on the primary intermediate forwarder. When bringing up the back-up intermediate forwarder, it would read, forward all the historical data from when it was last run which needs to be avoided. In this case, doesn't using followTail = 1 make sense? If not, what would be a better scenario for a back-up intermediate forwarder? ... View more

does anyone know if this issue was addressed in 6.3? ... View more

adding the -auth argument doesn't make a difference. It just prevents you from getting prompted for credentials. ... View more

I ran the following on each of the 3 search heads (splunk1,2,3) after installing splunk, configuring them as License slaves, and changing the admin passwords. /opt/splunk/bin/splunk init shcluster-config -mgmt_uri https://splunkdeployer:8089 -replication_port 9200 -secret XXXXX Then I ran this on one of the search heads: /opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list https://splunk1.acml.com:8089,https://splunk2.acml.com:8089,https://splunk3.acml.com:8089 and got the following... In handler 'shclustermemberconsensus': Failed to Set Configuration. One potential is captain could not hear back from all the nodes in a timeout period. Ensure alladded nodes are up, and increase the raft timeout. If all nodes are up and runningat splunkd.log for appendEntries errors due to mgmt_uri mismatch ... View more

We are having the same issue in the same scenario. Looking for a solution now....we are using 6.2.4 on linux ... View more

I'm having the same issue. Looking for a solution now.. ... View more