topic Re: Cannot find bid in Splunk Enterprise

Cannot find bid

jfaldmomacu — Wed, 02 Apr 2025 16:40:19 GMT

I'm getting thousands of log events that says --
ERROR CMSlave [2549383 CMNotifyThread] - Cannot find bid=wineventlog~157~96ECF7C4-1951-4288-B90A-9133E5408F14. cleaning up usage data

It is on all my indexers and references multiple but not all indexes.

Any ideas on how to fix that error?

Re: Cannot find bid

isoutamo — Wed, 02 Apr 2025 18:57:40 GMT

You should try to find another events which contains this bid from your _internal log. Those probably give you some hints what cause this error message.

Re: Cannot find bid

jfaldmomacu — Wed, 02 Apr 2025 20:58:30 GMT

I picked a bid and searched for it. The only events are about its creation. Then the errors immediately start

I checked three other bids with the same results. I even see messages about moving from hot to warm. ("Cleaning up usage" events excluded in these search results.)

Re: Cannot find bid

isoutamo — Wed, 02 Apr 2025 21:07:11 GMT

What is your repFactor on indexes.conf file for those indexes?
And have you on multisite or single site cluster? And what are your RF + SF and site factors if you have multisite cluster?

Re: Cannot find bid

jfaldmomacu — Wed, 02 Apr 2025 22:17:41 GMT

I've seen the repFactor set to auto or 0. I'm changing all the non-internal indexes to auto, (adding the line repFactor to the stanzas that are missing them.
RF and SF are 2.
I have a Single site cluster with 6 indexers.

Re: Cannot find bid

jfaldmomacu — Wed, 02 Apr 2025 22:19:49 GMT

But the ones that were missing the specified repFactor were the ones that had thousands of events. The other indexes that already had repFactor set to auto only had a few events with that error. So I think you may be on to something,

Re: Cannot find bid

isoutamo — Wed, 02 Apr 2025 22:24:18 GMT

In cluster you should also change internals to auto! Otherwise splunk don't replicate those buckets!