I think this question is testing our understanding of how the Splunk index cluster handles a frozen bucket. I'll need to carefully consider the different options and how the cluster master and indexers would respond.
Ah, I think I see the issue. The lack of flags for the (1.1.1.1, 239.1.1.1) entry suggests it may not be permitted, while the flags for the (1.1.1.1, 232.1.1.1) entry indicate that range is allowed. Time to review the multicast addressing rules.
Chan
4 months agoDona
4 months agoLorita
4 months agoAltha
5 months agoFabiola
5 months agoPrincess
5 months agoKatina
5 months agoAnnice
5 months agoGeorgeanna
5 months agoOdette
5 months agoIola
5 months agoRaylene
5 months agoLewis
5 months agoColene
5 months ago