About asetiawan

asetiawan · ‎01-14-2014

For StreamedSearch error, time sync between our NFS server and the search head seems to be the issue. Once we turned on ntpd on all of them, I no longer see this issue. For some reason, the internal logs indicated that the full bundles is keep being sent over to the indexers instead (should be incremental). For ProcessDispatchedSearch, I was told that it's a bug that has already been fixed on the later version. If I recall correctly, it has something to do with zipping and unzipping bug.

asetiawan · ‎11-04-2013

I experienced similar issue when my indexer is out of disk space. Splunk 6 seems to require min 5GB free space by default. So, if you have less than 5GB space on version 5.x and upgraded to version 6, your indexer will stop receiving logs and see warning messages like: skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block You can still search indexed logs, but the indexer status on the cluster master's clustering dashboard will be "Detention"

asetiawan · ‎04-15-2013

In my personal experience, using ntpd doesn't completely eliminate the issue. Granted that the frequency goes down from every 10 minutes (when I cron every hour), to a few of them using ntpd. Maybe the timestamp checking is just too strict?

asetiawan · ‎04-12-2013

What I would do: User, roles, authentication: - Copy $SPLUNK_HOME/etc/passwd (your user-password-roles pair) - Copy authorize.conf from $SPLUNK_HOME/etc/system/local/ (your roles definition) App/searches/Views. Locate your apps on $SPLUNK_HOME/etc/apps/ If you do everything in "search" app, don't copy the search app folder completely as it might give you headache later on when you upgrade. I'll do the following inside of the search app: - copy your "local" folder (it has your searches, views, macros, lookups) - copy metadata/local.meta if you want to preserve who owns what searches (it's not important) For other apps that you have created from barebone template, you can simply copy over the whole app folder. This works well in my experience.

asetiawan · ‎04-12-2013

I'm seeing this error message on the indexer frequently. 04-12-2013 19:05:53.085 +0000ERROR StreamedSearch - Failed to create a bundles setup with server name ' '. Using peer's local bundles to execute the search, results might not be correct and 04-12-2013 19:05:53.084 +0000 WARN StreamedSearch - Could not find bundles for search head provided checksum=5336122915231021645. Using latest bundles. on the search head, I frequently see this error: 04-12-2013 19:58:11.004 +0000 ERROR ProcessDispatchedSearch - PROCESS_SEARCH - Error opening "": No such file or directory When this happen, search head returns: Search results may be incomplete, peer 's search ended prematurely. This may be caused by a variety of reasons, please consult logs on peer for details! and no result is given. THe search head is a part of search head pooling. Anybody has seen this error before?

Posts	5
Solutions	1
Karma Given	2
Karma Received	11
Member Since	‎09-14-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

StreamedSearch - Failed to create a bundles setup ...

Re: StreamedSearch - Failed to create a bundles se...

Re: splunk clustered index upgrade to version 6

Re: when using ntpdate I see ERROR ProcessDispatch...

Re: Search Head - migrating apps, views and users ...

StreamedSearch - Failed to create a bundles setup ...