Splunk Dev

replication was unsuccessful. replicationStatus Failed failure info: failed_because_NONE

rusty009
Path Finder

Hi ,

I'm seeing a weird issue in splunk– I am getting the below error on my search head,

• Unable to distribute to peer named pdc1secsplkidx3 at uri https://10.100.50.13:8089 because replication was unsuccessful. replicationStatus Failed failure info: failed_because_NONE
• Unable to distribute to peer named pdc1secsplkidx2 at uri https://10.100.50.12:8089 because replication was unsuccessful. replicationStatus Failed failure info: failed_because_NONE
• Unable to distribute to peer named pdc1secsplkidx1 at uri https://10.100.50.11:8089 because replication was unsuccessful. replicationStatus Failed failure info: failed_because_NONE

those are my three indexers, when I restart the searchead it works for about 5 minutes and then it doesn’t seem to be able to search any data.

I can search historic data (no earler than yesterday) fine on the CM, so I think there is an issue with the search head,

Where can i look further?

Tags (1)
0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Hi rusty009, this seems like an issue with the bundle size, or otherwise some issue with the search head transmitting the bundle to the indexer. This is a tarball of config files, which tends to grow over time, and usually gets tipped over the edge by large lookup files.

My recommendation is to look at the internal log for the indexers and search on

index=_internal method=POST status!=200 source="*splunkd_access.log"

If you find events indicating issues, you can configure replicationBlacklist in server.conf to stop certain files or directories from being included in the bundle, or otherwise remove unneeded files entirely.

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi rusty009, this seems like an issue with the bundle size, or otherwise some issue with the search head transmitting the bundle to the indexer. This is a tarball of config files, which tends to grow over time, and usually gets tipped over the edge by large lookup files.

My recommendation is to look at the internal log for the indexers and search on

index=_internal method=POST status!=200 source="*splunkd_access.log"

If you find events indicating issues, you can configure replicationBlacklist in server.conf to stop certain files or directories from being included in the bundle, or otherwise remove unneeded files entirely.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...