All Apps and Add-ons

Issues with reintegrating buckets after stopping/restarting instances AWS

malickattitude
New Member

Following a reboot of our SPLUNK instances in AWS, we have lost all data before, currently, I am having trouble reintegrating the bucket by build and some indexers are no longer operational.

Here is the message of the log to integrate a specific bucket and the HS warning.

==>

idx=firedalerts Path homePath='/opt/splunk/var/lib/splunk/firedalerts/db' (realpath '/opt/splunk/var/lib/splunk/firedalerts/db') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by homePath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=firedalerts Path coldPath='/opt/splunk/var/lib/splunk/firedalerts/colddb' (realpath '/opt/splunk/var/lib/splunk/firedalerts/colddb') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=os Path homePath='/opt/splunk/var/lib/splunk/os/db' (realpath '/opt/splunk/var/lib/splunk/os/db') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by homePath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
idx=os Path coldPath='/opt/splunk/var/lib/splunk/os/colddb' (realpath '/opt/splunk/var/lib/splunk/os/colddb') is inside volume=primary (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Please check indexes.conf for configuration errors.
Operating on: idx=purecloud bucket='/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525'
(subchild_41__SplunkOptimize)  splunk-optimize start: dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp mode=0 isfinal=true max_iteration=2147483647 min_src_count=2 lex_tpb=64
(subchild_41__SplunkOptimize)  optimize finished: files merged successfully, dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp, rc=0 (unsigned 0), errno=2
(subchild_41__SplunkOptimize)  optimize finished: less than 2 tsidx files in dir, dir=/opt/splunk/var/lib/splunk/purecloud/db/rb_1575318618_1575318605_63_BE69D48B-3DBD-49C5-B901-D0252C325525-tmp, rc=-30 (unsigned 226), errno=2
(subchild_41__SplunkOptimize)  exiting splunk-optimize process with rc=-30 (unsigned 226)


<==

Please for helping !

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...