[解决]Splunk KV Store initialization has not completed

  • Post author:
  • Post category:其他

1: 背景:

今天客户反映数据搜索的时候,不是很稳定,想确定一下 ,这个是什么原因造成的,我去系统里看一下,检查了一下kvstore 有问题:

03-17-2023 00:39:02.459 -0700 ERROR DataModelObject [74341 SchedulerThread] – Failed to parse baseSearch. err=Error in ‘inputlookup’ command: External command based lookup ‘correlationsearches_lookup’ is not available because KV Store initialization has not completed yet.

看来是kvstore 没有同步,下面查一下资料:

Resync the KV store – Splunk Documentation

Resync stale KV store members

If more than half of the members are stale, you can either recreate the cluster or resync it from one of the members. See Back up KV store for details about r


版权声明:本文为shenghuiping2001原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接和本声明。