The endpoint for a destructive resync should be /services/replication/configuration/commits If you notice the baseline is out of sync in the splunkd.logs, or if you find yourself seeing the banner message to run a destructive resync, run the following command (should work): curl -k -u admin:splunker https://127.0.0.1:8089/services/replication/configuration/commits Basically is the equivalent of : ./splunk resync shcluster-replicated-config Based off of $SPLUNK_HOME/etc/system/static/splunkrc_cmds.xml 1801 <item obj="shcluster-replicated-config"> 1802 <cmd name="resync"> 1803 <uri><![CDATA[/replication/configuration/commits]]></uri> 1804 <default> 1805 <arg name="resync_destructive" value="1" /> 1806 </default> 1807 <help> 1808 <title><![CDATA[Destructively resyncs this node to the latest replicated config on the captain.]]></title> 1809 <examples> 1810 <ex><![CDATA['./splunk resync shcluster-replicated-config]]></ex> 1811 </examples> 1812 </help> 1813 <type>edit</type> 1814 </cmd> 1815 </item> ... View more

It looks like you hint a low disk space limit here: 11-03-2015 04:40:36.779 -0500 ERROR DiskMon - Cannot write data to index path "/opt/splunk/var/lib/splunk/audit/db" because you are low on disk space on partition "/". Indexing has been paused. Will resume when free disk space rises above 5000MB. either free up disk space or decrease the limit in server.conf : [diskUsage] minFreeSpace = <num> * Specified in megabytes. * The default setting is 5000 (approx 5GB) ... View more

Thanks ykou and MuS: I managed to do it by making distributed search groups. Still weird that the assets.csv is missing though. ... View more

Sorry just saw I accidentally wrote in the original post I added them in Set Up instead of Distributed search > search peers. Sorry for the confusion. ... View more

@sandipta : Your solution works like a CHARM 🙂 🙂 ... View more