Splunk的疑难杂症

01 KVStora问题

1.1 问题描述

splunkd.log 日志中出现“ERROR KVStorageProvider [1542 KVStoreUpgradeStartupThread] - An error occurred during the last operation ('replSetGetStatus', domain: '15', code: '13053'): No suitable servers found (serverSelectionTryOnce set): [connection closed calling hello on '127.0.0.1:8191']​”报错

1.2 解决方案

1. 重新生成server.pem 文件

   停止Splunk服务：/opt/splunk/bin/splunk stop​

   备份 /opt/splunk/etc/auth/server.pem文件，进入 /opt/splunk/etc/auth​目录

   ​cd /opt/splunk/etc/auth && mv server.pem server_bak.pem​

   启动Splunk服务，重新生成server.pem文件：/opt/splunk/bin/splunk start​

2. 清理本地kv存储库<在问题实例上>

   停止Splunk服务：​/opt/splunk/bin/splunk stop​

   清理本地kvstore存储库：/opt/splunk/bin/splunk clean kvstore --local​

   启动Splunk服务：/opt/splunk/bin/splunk start​

‍