I have not found a solution for this, but it seems that it does not affect the functionality, as the logs are being sent as expected. ... View more

So you terminated old node and then a new one bring up. But how about splunk in these cases? How it was installed and how about configurations and old data or was this totally clean installation which then added to cluster or was it old installation with GUI, <index>.dat files + real indexes? ... View more

Hello , In versions 9.3.x, 9.4.x there is a "route" parameter added by default http stanza of splunk_httpinput app (inputs.conf). Make sure this parameter is not overridden by any local inputs.conf. You can try adding this parameter to the http stanza of your HF "route=has_key:_dstrx:typingQueue;has_key:_linebreaker:rulesetQueue;absent_key:_linebreaker:parsingQueue" and try. ... View more

Excellent. Always good to give it a restart to refresh everything. ... View more

I'll answer to my post/question, could be helpful for someone in similar situation. The issue was caused by 3 not existing roles which were still present in authorize.conf. Disabled those roles in authorize.conf and the update worked. ... View more