Reporting

BucketSummaryProcessor - Timed out waiting for bucket summary creation thread

agneticdk
Path Finder

Hi all

Any of you guys upgraded / installed Splunk Enterprise 7.1 / 7.1.1 and have extensive use of accelrated datamodels ? Fx Enterprise Security 5.1 ?

We have seen a jump in load to 100% CPU usage at the time of upgrade. (And yes this is several weekas ago and the datamodels have been rebuild) And we run on 32 core machines that used to have a load of about 5-6, jumped to a load of 30-31 and has not come down since, neither via rebuild datamodels manually, or by rebooting. Only by disabling datamodel acceleration it helped, which is not doable when running ES.

We see many errors on all datamodel accerelerations when looking in the search.log in the dispatch catalogue on our indexeres.

ERROR BucketSummaryProcessor - Timed out waiting for bucket summary creation thread

Any of you guys have seen same issues ?
We have a support case running wil support also, but we haven't got any reply yet on these errors.

André

0 Karma

jacobrush
New Member

We are in the exact same situation. Did you manage to figure anything out?

0 Karma

stboch_umd
Explorer

Waiting for a mod to approve my answer but set the backfill time in the CIM Setup in Enterprise Security it is an issue where the backfill is extending beyond the earliest time of data.

0 Karma

stboch_umd
Explorer

There is a known issue with Data Model Acceleration and the backfill time.
Set the acceleration.backfill_time = (some time no earlier than data in the index)
This can be set in the CIM setup in Enterprise Security or in the datamodels.conf in etc/apps/Splunk_SA_CIM/local

0 Karma

larshaugan
Explorer

What mitigated this problem for us, was to add acceleration.backfill_time to all accelerated data models (under the DM stanza in datamodels.conf). Set this to <= acceleration.earliest_time. (I assume this is only a issue with 7.1.1).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...