×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
Jtorge
Explorer
Member since: ‎02-18-2026
‎03-19-2026
Community Statistics
Posts 7
Solutions 0
Karma Given 4
Karma Received 0
Member Since ‎02-18-2026
Activity Feed
View All

Re: Half of my cluster is not authenticating after...

by in Splunk Enterprise
‎03-19-2026 05:37 AM
‎03-19-2026 05:37 AM
@livehybrid  To upgrade I simply did a wget for the 10.2.1.rpm upgrade and then installed it using "rpm -Uvh 10.2.1 upgrade". I didnt touch any of my pass4symm or secret keys. That is why I am so baffled, it was a very routine upgrade. ... View more

Re: Half of my cluster is not authenticating after...

by in Splunk Enterprise
‎03-18-2026 10:03 AM
‎03-18-2026 10:03 AM
In splunkd.log it just shows 401 errors for three of my six indexers and says they are failing to authenticate with "auth-token" we have not set up auth tokens up on those indexers and they should be using TLS/SSL certs. I have verified permissions, any my cert paths in my server.conf. In my cluster manager it shows that search factor is met and all six of my indexers are up and searchable. However, my monitoring console shows them as unreachable.  ... View more

Half of my cluster is not authenticating after and...

by in Splunk Enterprise
‎03-18-2026 07:07 AM
‎03-18-2026 07:07 AM
Yesterday I updated from Splunk ES 10.2.0  to 10.2.1. After the update I started seeing these errors in half of my six indexers.  -0400 WARN DistributedPeerManager [128779 BundleReplicatorThread] - Peer https://100.00.00.000:8089 cannot receive bundles, considered unhealthy. Will be removed from peers to replicate to for now. -0400 WARN GetRemoteAuthToken [128250 DistributedPeerMonitorThread] - Unable to get authentication token from peeruri="https://100.00.00.000:8089/services/admin/auth-tokens". -0400 WARN DistributedPeer [128250 DistributedPeerMonitorThread] - Peer:https://100.00.00.000:8089 Failed to get server info from https://100.00.00.000:8089/services/server/info response code=401 I have verified that my auth configurations are the same and my certificates were not modified. Please provide troubleshooting tips, thank you. ... View more

Events not returned in sub-second order

by in Getting Data In
‎02-24-2026 07:01 AM
‎02-24-2026 07:01 AM
I recently started pulling Tenable data in through the Tenable Add-on for Splunk, and when I search the data in Search and Reporting it produces this error. "[FQDN.domain.mil,FQDN.domain.mil] Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk." I searched through search.log and found no further information, and I am able to search Tenable data. What I want to know is how this ultimately effects search performance or data searchability/availability? Can I clear this error by simply increasing the max_rawsize_perchunk in the props.conf? ... View more
Labels

Re: Avoiding double ingestion

by in Getting Data In
‎02-23-2026 08:07 AM
‎02-23-2026 08:07 AM
Thank you, I'll certainly consider doing that. I'll have to get a little more familiar with load balancers.  ... View more

Re: Avoiding double ingestion

by in Getting Data In
‎02-23-2026 08:05 AM
‎02-23-2026 08:05 AM
Rick, as of right now, I don't have any more information about the mysterious two syslog servers. An admin reached out with the scenario, and I couldn't think of any way to prevent duplication from a situation like this. My mind went straight to a custom-scripted input as you described, but I wanted to know if there was a simpler solution. Once the admin sets up what they've described, and I have a more realistic view of the project, I can update this with better specifics. Thank you for the advice.  ... View more

Avoiding double ingestion

by in Getting Data In
‎02-18-2026 07:00 AM
‎02-18-2026 07:00 AM
I have a RHEL admin who is building two syslog servers to ingest data from one RHEL node redundantly. These two syslog servers will forward their data to two Network File Storage (NFS) mounts. To meet security requirements, we need to forward the data from both of those NFS mounts to our indexers. I am worried about indexing duplicate data and using twice as much license as needed for that data. Is there a way to index the data from one NFS at a time and if it crashes/fails, have a forwarder ready to automatically cutover and continue sending data to be indexed? Please advise.   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-19-2026 05:35 AM
Karma given to