BucketMover moving to cold on UNC

jrich523 — Mon, 28 Sep 2020 15:17:43 GMT

I get the following error:

ERROR BucketMover - aborting move because recursive copy from src='C:\Program Files\Splunk\var\lib\splunk\f5test\warmdb\db_1380909713_1380904989_18' to dst='\10.20.120.120\Splunk\Node01\F5test\inflight-db_1380909713_1380904989_18' failed (reason='The operation completed successfully.')

I is indication successful but i check the folder and there is nothing there.

I logged in to the server (windows 2012 R2) as the service account that runs splunkd and checked to make sure access was ok and im able to create/read/write ok. Also it created the F5Test folder when i added the cold path to the index so its not an access issue.

I ran procmon to see if it showed anything and I can see it trying to access the path

1:42:54.2746637 PM splunkd.exe 1684 CreateFile \10.20.120.120\splunk\Node01\F5test\inflight-db_1380909713_1380904989_18 NAME NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

So that seems normal, based on the fact that the file isnt there and it should be the Copy (CreateFile is used for a lot of things)

Is there something else i can do to look at why this might not be working?

thanks

Re: BucketMover moving to cold on UNC

jrich523 — Fri, 15 Nov 2013 22:00:26 GMT

one part I left out, that was important to solving this was that i had moved the Warm files previously and it had screwed up the permissions so the problem was i didnt have access to move the local files. reset permissions and things started to move.

topic Re: BucketMover moving to cold on UNC in Getting Data In

BucketMover moving to cold on UNC

Re: BucketMover moving to cold on UNC