1: 背景:
今天客户反映数据搜索的时候,不是很稳定,想确定一下 ,这个是什么原因造成的,我去系统里看一下,检查了一下kvstore 有问题:
03-17-2023 00:39:02.459 -0700 ERROR DataModelObject [74341 SchedulerThread] - Failed to parse baseSearch. err=Error in 'inputlookup' command: External command based lookup 'correlationsearches_lookup' is not available because KV Store initialization has not completed yet.
看来是kvstore 没有同步,下面查一下资料:
Resync the KV store - Splunk Documentation
Resync stale KV store members
If more than half of the members are stale, you can