topic Re: When should I restore from backup? in Getting Data In

When should I restore from backup?

pdevlin — Thu, 19 Aug 2010 05:35:55 GMT

What events should I be watching for in my Splunk logs? Does anyone have a list of specific error codes that would indicate the need to restore an index?

Re: When should I restore from backup?

gkanapathy — Thu, 19 Aug 2010 10:39:59 GMT

I guess I'm not sure why you want to restore an index from backup. It's an extremely abnormal condition, and I suppose that many things that went wrong could cause it, but if it did, someone is going to see something go wrong in the application, not the log.

Re: When should I restore from backup?

pdevlin — Fri, 20 Aug 2010 01:14:34 GMT

Index corruption, disk errors or VM/OS failures that cause file corruption, etc. I'd like to monitor Splunk logs for those specific errors that indicate an index is corrupt and/or not usable. Yes we would notice in the application that something is wrong but knowing the exact errors which indicate a corrupt index is vital for basic maintenance and support. Do you know if there is a complete list of Splunk error codes and what they mean?