Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About sathwik067
sathwik067
Explorer
Member since:
01-29-2020
02-17-2026
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 7 |
| Karma Received | 1 |
| Member Since | 01-29-2020 |
Activity Feed
- Posted Re: We are building a new indexer cluster and getting search and replication factor errors on Installation. 05-23-2023 09:33 AM
- Karma Re: Splunk DB Connect Error:Unable to initialize modular input "server" for Roy_9. 12-08-2022 12:36 PM
- Karma Re: Splunk DB Connect: How to resolve "Can not communicate with task server, check your settings" error messag for edoardo_vicendo. 12-08-2022 12:36 PM
- Posted Re: Why is the Windows TA broken out of the box? on All Apps and Add-ons. 08-11-2022 08:12 AM
- Karma Why is the Windows TA broken out of the box? for merch_sf. 08-11-2022 08:10 AM
- Posted trying to uninstall ITSI from search head cluster on Splunk Enterprise. 01-19-2022 03:18 PM
- Karma Re: Search factor vs Replication factor for VatsalJagani. 08-30-2021 10:50 AM
- Posted We built a new indexer cluster and trying to reroute some of the ingestion from current cluster to new cluster on Splunk Enterprise. 12-09-2020 09:50 AM
- Posted Re: We are building a new indexer cluster and getting search and replication factor errors on Installation. 12-04-2020 07:27 AM
- Posted Re: We are building a new indexer cluster and getting search and replication factor errors on Installation. 11-18-2020 09:09 AM
- Posted Re: We are building a new indexer cluster and getting search and replication factor errors on Installation. 11-16-2020 04:27 PM
- Karma Re: We are building a new indexer cluster and getting search and replication factor errors for richgalloway. 11-16-2020 09:23 AM
- Posted Re: We are building a new indexer cluster and getting search and replication factor errors on Installation. 11-16-2020 09:22 AM
- Posted Why are we receiving search and replication factor errors while ee are building a new indexer cluster? on Installation. 11-16-2020 07:06 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
05-23-2023
09:33 AM
Hi @DarshanBK, if you are running Linux, your Linux team can make this change, there is nothing you can do on the Splunk end. To see the MTU value you can run "ifconfig" command and it will give you the output of this MTU value along with some other information about the server and the mounts it has.
... View more
08-11-2022
08:12 AM
Hi, Can you please let me know if you find any solution for this? I am still not able to figure out this errors.
... View more
01-19-2022
03:18 PM
Hello, We are trying to uninstall ITSI from our search head cluster, so i removed all the ITSI related apps and add-ons from the deployer and pushed to the cluster and the bundle also got pushed successfully but the search heads did not take any rolling restart and the ITSI related apps are still there on the search heads. I did a manual rolling restart but they are still there. can anyone please let me know if you ran into this issue before. Thanks, Sathwik.
... View more
Labels
- Labels:
-
installation
12-09-2020
09:50 AM
Hello all, we built a new cluster as we are getting out of space on current one and we are trying to reroute some of the ingestion to the new cluster by adding the new indexer clusters stanza in the outputs.conf and using _TCP_ROUTING setting in the inputs.conf the servers we want to reroute the ingestion. below is the stanza we added in outputs.conf [tcpout:ABC_indexers] Server = xx.xx.xx.xx.xx:9997, xx.xx.xx.xx.xx:9997, xx.xx.xx.xx:9997 useACK = true in the inputs.conf we added below setting and pushed it to the servers we want to reroute the data and restarted the forwarder service: _TCP_ROUTING = ABC_indexers but we are not seeing any ingestion to the new cluster and we are getting few errors and warning. We checked that the forwarders are connected to all our new indexers over 9997 port. WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group ABC_indexers has been blocked for 800 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. "INFO ProxyConfig - Failed to initialize https_proxy from server.conf for splunkd. Please make sure that the https_proxy property is set as https_proxy=http://host:port in case HTTP proxying needs to be enabled." we checked everything on the indexers but could not find out what is blocking the indexers to receive the data. We have cluster master which is ingesting internal logs to this new indexers and that is not having any issue. Please let me know if anyone got this issue and how you resolved it. Thanks
... View more
Labels
12-04-2020
07:27 AM
Hello all, The problem is the MTU setting on the 1 Gb bonded network interface is set to 9,000 on our new indexes. We changed it to 1500 and that fixed the search and replication factor. Thanks.
... View more
11-18-2020
09:09 AM
It is getting connected curl -v telnet://xx.xx.xx.xx:8080 * About to connect() to xx.xx.xx.xx port 8080 (#0) * Trying xx.xx.xx.xx... * Connected to xx.xx.xx.xx (xx.xx.xx.xx) port 8080 (#0)
... View more
11-16-2020
04:27 PM
Hello, thanks for the response. below are some of the errors we are seeing on the indexers "ERROR TcpInputProc - Error encountered for connection from src=xx.xx.xx.xx:xxxx. Read Timeout Timed out after 600 seconds." "BucketReplicator - Failed to replicate warm bucket bid=_internal~xx to guid=ABCD host=xx.xx.xx.xx s2sport=8080. Read timed out after 180 secs." Missing enough suitable candidates to create searchable copy in order to meet replication policy. Missing={ default:1 Waiting 'target_wait_time' before search factor fixup Cannot fix search count as the bucket hasn't rolled yet. Search peer abcd.com has the following message: Too many bucket replication errors to target peer=xx.xx.xx.xx:8080. Will stop streaming data from hot buckets to this target while errors persist. Check for network connectivity from the cluster peer reporting this issue to the replication port of target peer. If this condition persists, you can temporarily put that peer in manual detention
... View more
11-16-2020
09:22 AM
Hello, Thanks for the response. Yes, we have checked the connectivity between the indexers as well and the ports are connected between the indexers.
... View more
11-16-2020
07:06 AM
Hello all,
We are trying to build new indexer cluster with new cluster master. We installed splunk on all the servers and integrated indexers with the cluster master. After all the process we are getting search and replication factor errors with below warning messages. We check all the ports connectivity between all the indexers and the cluster master everything is connected but we still getting this warning. We tried cleaning up the eventdata as suggested in one of the posts but that did not work either. Please let me know if anyone faced this type of issue and resolved it that would be very helpful. Let me know if you need any more info.
We have search and replication factor = 2 with three indexers
Search peer abcd.com has the following message: Too many bucket replication errors to target peer=xx.xx.xx.xx:8080. Will stop streaming data from hot buckets to this target while errors persist. Check for network connectivity from the cluster peer reporting this issue to the replication port of target peer. If this condition persists, you can temporarily put that peer in manual detention.
Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-17-2026
11:31 AM
|
Karma given to
