We keep seeing errors of type: ERROR ArtifactReplicator - Failed to tar into file="C:\Program Files\Splunk\var\run\splunk\dispatch\_splunktemps\send\s2s\scheduler_<...>.tar" On our search heads. We have four search heads in our cluster and four indexers that are clustered evenly across two sites. This doesn't seem to be affecting Splunk search or alerting, but the members of the search head cluster keep flipping between "Up" and "Pending" status, which I think might be related. I've searched extensively, but haven't really been able to find anything. Does anyone know what might be going on? Thanks in advance! ... View more

When I run the following command on Windows (Splunk version 7.1.2, Windows version Server 2012 R2): splunk apply cluster-bundle -auth "username:password" --answer-yes I get the following output, which is expected: Created new bundle with checksum=<checksum> Applying new bundle. The peers may restart depending on the configurations in applied bundle. Please run 'splunk show cluster-bundle-status' for checking the status of the applied bundle. But it appears that splunk.exe also writes "OK" to stderr. As far as I can tell, nothing has actually failed and everything is working as expected. Am I missing something? Is there actually an error that I'm not aware of, or is this a bug? I can work around it, but it doesn't feel right. I'd like to make sure I'm not missing something important. ... View more