I have many entries like this:
WARN CMSlave - event=handleNotifySummaries error deserializing notify file=/raid/splunk/var/lib/splunk/websphere/datamodel_summary/notify/notify.1_7B6E7EF6-00F8-45EC-876E-4E57B8B867C3.08E505C1-07CE-4046-820E-A8FCD7CEA32C_DM_(...).MSExchange err=invalid notify summary file=notify.1_7B6E7EF6-00F8-45EC-876E-4E57B8B867C3.08E505C1-07CE-4046-820E-A8FCD7CEA32C_DM_(...).MSExchange
What does it mean?
I have 2 indexers on site1 and 2 on site2; all connected to Cluster Master.
This can be safely ignored as long as you're not using summary replication. (If using summary replication, these summaries will not be replicated amongst the cluster, and a workaround would be to rename the DataModel/ReportAcceleration to remove any "." in the name)
Hmm, same kind of warning here.
Don't know if there's any impact
splunk 6.4.1, linux redhat 6.8 64bit, ext4
I've got 4 new indexers in CM, all have the same warnings...
Open a support case.
same error here. Need to be fix from splunk
its been fixed in 6.4.3