Specific index stopped receiving logs. the SH _internal logs had an error"Unable to read from raw size file"

ITSplunk117 — Thu, 07 Mar 2024 14:35:53 GMT

Hello,

We had an index that stopped receiving logs. Since we do not manage the host sending the logs I wanted to get more information before reaching out. The one interesting error that showed up right about the time the logs stopped was the following. I have not been able to find anything useful about this type of error. Also the error is being thrown from the indexer.
Unable to read from raw size file="/mnt/splunkdb/<indexname>/db/hot_v1_57/.rawSize": Looks like the file is invalid.

thanks for any assistance I can get.

Re: Specific index stopped receiving logs. the SH _internal logs had an error"Unable to read from raw size file&qu

gcusello — Fri, 08 Mar 2024 08:09:42 GMT

Hi @ITSplunk117,

it seems that you have son inconsitancy in data files.

Open a ticket to Splunk Support, sending them a diag of these indexer.

Ciao.

Giuseppe

topic Re: Specific index stopped receiving logs. the SH _internal logs had an error"Unable to read from raw size file&qu in Getting Data In

Specific index stopped receiving logs. the SH _internal logs had an error"Unable to read from raw size file"

Re: Specific index stopped receiving logs. the SH _internal logs had an error"Unable to read from raw size file&qu