https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11077#M504 <P>The splunk-optimize process can´t run on that subdirectory, since it doesn´t exist. Even if i create it manually, splunk-optimize won´t notice, except by creating another error:</P> <PRE><CODE>05-11-2010 13:10:40.476 ERROR databasePartitionPolicy - Index is empty refusing to move. oldDirPath=/opt/splunk/splunk/var/lib/splunk/fishbucket/db/db-hot </CODE></PRE> <P>The other message is still there:</P> <PRE><CODE>05-11-2010 14:33:52.045 WARN timeinvertedIndex - splunk-optimize failed to start for index /opt/splunk/var/lib/splunk/fishbucket/db/db-hot </CODE></PRE> Tue, 11 May 2010 19:40:08 GMT tpaulsen 2010-05-11T19:40:08Z https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11073#M500 <P>Can't find a reference to the following error. What does it mean and how do I fix it?</P> <P>Indexing Significant Warns:</P> <P>WARN timeinvertedIndex - splunk-optimize failed to start for index /opt/splunk/var/lib/splunk/defaultdb/db/hot_quar_v1_17</P> Wed, 07 Apr 2010 19:47:44 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11073#M500 MikeyG 2010-04-07T19:47:44Z https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11074#M501 <P>Sporadic failures are to be expected, as there are times when Splunk will be indexing heavily to a particular hot DB, and it won't always be the optimal time for splunk-optimize to run on that particular bucket.</P> <P>If it's a consistent failure however, and splunk-optimize has never been able to run on that bucket, that may indicate a more serious problem with the data inside the bucket - a possible data corruption for example.</P> <P>If it's a consistent message, you should file a case with the Splunk Support team and they will work with you to determine the root cause - <A href="http://www.splunk.com/page/submit_issue" rel="nofollow">http://www.splunk.com/page/submit_issue</A></P> Wed, 07 Apr 2010 19:47:45 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11074#M501 Mick 2010-04-07T19:47:45Z https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11075#M502 <P>If it's expected, why is it a failure?<BR /> What does it mean that it isn't an optimal time, is this a locking issue?</P> Wed, 07 Apr 2010 19:47:46 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11075#M502 jrodman 2010-04-07T19:47:46Z https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11076#M503 <P>There is nothing to fix if it's rare. It just means that Splunk was busy at the time it would otherwise have run an optimization on the indexed data. Optimization runs frequently to improve the way data is stored in the index as new data gets added.</P> <P>If the warning occurs regularly, it is a sign that your system is overloaded. If the warning occurs more often than every few minutes, your indexed data may not be well optimized which will lead to slower searches over that data.</P> Wed, 07 Apr 2010 21:33:03 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11076#M503 gkanapathy 2010-04-07T21:33:03Z https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11077#M504 <P>The splunk-optimize process can´t run on that subdirectory, since it doesn´t exist. Even if i create it manually, splunk-optimize won´t notice, except by creating another error:</P> <PRE><CODE>05-11-2010 13:10:40.476 ERROR databasePartitionPolicy - Index is empty refusing to move. oldDirPath=/opt/splunk/splunk/var/lib/splunk/fishbucket/db/db-hot </CODE></PRE> <P>The other message is still there:</P> <PRE><CODE>05-11-2010 14:33:52.045 WARN timeinvertedIndex - splunk-optimize failed to start for index /opt/splunk/var/lib/splunk/fishbucket/db/db-hot </CODE></PRE> Tue, 11 May 2010 19:40:08 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-optimize-Warning/m-p/11077#M504 tpaulsen 2010-05-11T19:40:08Z