×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
oofaustoo
Explorer
Member since: ‎04-15-2011
‎06-05-2020
Community Statistics
Posts 3
Solutions 1
Karma Given 1
Karma Received 1
Member Since ‎04-15-2011
View All

Re: Does splunk support search head pooling via cl...

by in Deployment Architecture
‎08-21-2013 10:33 AM
1 Karma
‎08-21-2013 10:33 AM
1 Karma
I tackled this by creating a replicated glusterfs volume for all my peer nodes, and then locally mounted on each node via nfs. glusterd does it's thing in the background and Splunk just deals with the nfs share. With the nfs share being locally mounted, I was able to take aggressive mount options for rsize/wsize. On top of all that, I'm using mode=6 bonding (balance-alb) for the nics. ... View more

Re: Regenerating the bucket manifest

by in Deployment Architecture
‎01-03-2013 01:04 PM
‎01-03-2013 01:04 PM
Setting serviceMetaPeriod in /opt/splunk/etc/system/local/indexes.conf solved the problem (thanks to Splunk Support for the solution!). The default serviceMetaPeriod is 25 seconds. Since the regenerate for one of my high volume indexes was taking in excess of 22 seconds incoming data was only being serviced by the indexer pipeline for around 3 seconds every 25 seconds. That was causing all my indexqueue congestion. Example (from local indexes.conf): [default] serviceMetaPeriod = 150 ... View more

Regenerating the bucket manifest

by in Deployment Architecture
‎01-02-2013 11:33 AM
‎01-02-2013 11:33 AM
Ever since upgrading from Splunk 4.2 to 4.3.5 I am getting the following in my splunkd.log: 01-02-2013 14:26:43.994 -0500 INFO databasePartitionPolicy - Regenerating the bucket manifest (index=ss)... 01-02-2013 14:27:05.091 -0500 INFO databasePartitionPolicy - Completed regenerating the bucket manifest. 01-02-2013 14:27:09.148 -0500 INFO databasePartitionPolicy - Regenerating the bucket manifest (index=ss)... 01-02-2013 14:27:30.527 -0500 INFO databasePartitionPolicy - Completed regenerating the bucket manifest. 01-02-2013 14:27:34.739 -0500 INFO databasePartitionPolicy - Regenerating the bucket manifest (index=ss)... 01-02-2013 14:27:56.194 -0500 INFO databasePartitionPolicy - Completed regenerating the bucket manifest. index=ss is my highest volume index (roughly 30GB incoming per day). Ever since upgrading to 4.3.5 from 4.2 this "manifest regeneration" is kicking off every 30 seconds and taking 20+ seconds to complete. My index latency has been abysmal since the upgrade (roughly 2 hours behind during peak hours). Can I assume that during this "manifest regeneration" that indexing is paused while it does it's thing and thus causing indexing to lag? Anyone run into this? If so, any fix? Thanks! ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from
View All
Karma given to
View All