topic Error message is displayed when I rebuild archive data. in Getting Data In

Error message is displayed when I rebuild archive data.

yutaka1005 — Fri, 19 Jan 2018 07:43:42 GMT

When I rebuild archive data, ERROR message is displayed like below.

ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to check if idx= is an index with a remote storage, but that index does not exist on the system or is disabled

However, the rebuilt data will be displayed normally as a result when I search it.

What is this message?
My index data is not under the default "SPLUNK_HOME/var/lib/splunk/", but it is placed under "/data" which is another partition.
Is it related to this "ERROR"?

Re: Error message is displayed when I rebuild archive data.

mayurr98 — Fri, 19 Jan 2018 07:59:24 GMT

does that index exist on your system where you are archiving the data?

Re: Error message is displayed when I rebuild archive data.

yutaka1005 — Tue, 29 Sep 2020 17:41:29 GMT

Index folder including "thawed_db" and frozen path storing archive data is under "/data" which is a different partition, not "SPLUNK_HOME/var/lib/splunk/".

The index that used to rebuild the archive data is under "/data" too.

Re: Error message is displayed when I rebuild archive data.

mayurr98 — Fri, 19 Jan 2018 08:25:47 GMT

not the index folder i am talking about the index that you configure in local/indexes.conf

Re: Error message is displayed when I rebuild archive data.

yutaka1005 — Fri, 19 Jan 2018 08:29:35 GMT

Yeah! It certainly exists.

Because I can specify the index and retrieve the rebuilt data on SPL like below.
search index=... |

Re: Error message is displayed when I rebuild archive data.

Elsurion — Fri, 19 Jan 2018 09:08:47 GMT

Hi Yutaka

Have you modified your SPUNK_DB Variable in the ~/etc/splunk-launch.conf Conffile?
Normaly it is not set, so the default path is taken.

# By default, Splunk stores its indexes under SPLUNK_HOME in the
# var/lib/splunk subdirectory.  This can be overridden
# here:
#
# SPLUNK_DB=/home/build/build-home/ember/var/lib/splunk
SPLUNK_DB=/some/path

Re: Error message is displayed when I rebuild archive data.

yutaka1005 — Tue, 29 Sep 2020 17:41:35 GMT

Thank you for answer Elsurion!

Yes I haven't modified "SPLUNK_DB" variable.
But I don't use $SPLUNK_DB$ in indexes.conf.

I configured like below in indexes.conf.

coldPath = /data/lndexes/<index_name>/colddb
homePath = /data/lndexes/<index_name>/db
thawedPath =/data/lndexes/<index_name>/thaweddb
coldToFrozenDir =/data/Frozen/<index_name>

Re: Error message is displayed when I rebuild archive data.

yutaka1005 — Fri, 19 Jan 2018 10:02:09 GMT

I think this may be bug of Splunk ver 6.6.4.

Because, just install Splunk 6.6.4,
The same error message appeared even if following steps were taken.

Upload data that will be archived soon to index "test".
Restart Splunk and archive the data.

3.Copy the archive data to $SPLUNK_DB/test/thaweddb and execute the following command.

/opt/splunk/bin/splunk rebuild db_1424259300_1424259300_1/

Then the following error appears.

ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to 
check if idx= is an index with a remote storage, but that index does not exist on the 
system or is disabled

indexes.conf

[test]
coldPath = $SPLUNK_DB/test/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test/thaweddb
bucketRebuildMemoryHint = 0
coldToFrozenDir = /opt/splunk/var/lib/splunk/frozen
compressRawdata = 1
enableOnlineBucketRepair = 1
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1
frozenTimePeriodInSecs = 10000

Re: Error message is displayed when I rebuild archive data.

Elsurion — Fri, 19 Jan 2018 10:08:38 GMT

one other thing i have done on an installation is a symbolic link from the var/lib/splunk to the index folder. Might help.
link between ~/var/lib/splunk and /data/Indexes

Re: Error message is displayed when I rebuild archive data.

yutaka1005 — Thu, 25 Jan 2018 06:16:25 GMT

splunk support said this message can be ignored.

Re: Error message is displayed when I rebuild archive data.

claudio_manig — Fri, 16 Mar 2018 12:16:39 GMT

THANK YOU SIR