Getting Data In

Indexer Cluster: Why am I seeing "event=replicationData... event=rename replicationType=eJournalReplication status=failed" errors on one indexer?

vaianna
New Member

Hi,

I have a Splunk indexer cluster with these parameters:
1 Master node
1 Search Head node
2 Indexers
2 Forwarders
RF = 2, SF = 2, both don't respected

For several days, and in this moment, with a real-time search on _internal index, I see on the first Indexer many sequences of these type of errors. The other indexer doesn't have the same problem.

ERROR TcpInputProc - event=replicationData status=failed err=
ERROR S2SFileReceiver - event=rename replicationType=eJournalReplication  status=failed err=Rename failed in 1 attempt(s) made between  status code: 17

Which can be the cause of this behavior?

Thanks,

0 Karma

Prakhar_shukla
Path Finder

it is most likely happening because of corrupted buckets, you can see them in cluster master webpage as well. to fix the issue you need to remove them. please see how to remove bucket in this post

https://answers.splunk.com/answers/184484/what-should-i-do-with-bad-buckets-in-a-clustered-e.html?so...

0 Karma

vasanthmss
Motivator

@Vaianna: Check this post https://answers.splunk.com/answers/295363/why-am-i-getting-error-s2sfilereceiver-eventstatsi.html

There are few of the checklist available to validate. If you have found the root cause share it..

V
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...