https://community.splunk.com/t5/Getting-Data-In/Unable-to-fix-Bucket-corruption-rawdata-was-truncated/m-p/392403#M70106 <P>Hiya Bucketheads</P> <P>after running rebuild on a index, quite a lot of buckets were not fixed with below reason. </P> <PRE><CODE> failed: Error reading rawdata at offset=xxxxxx : rawdata was truncated </CODE></PRE> <P>What is the cause of this problem .</P> <P>Can those buckets be fixed at all ? The rebuild process was not successful so I have doubts?</P> <P>we have previously tried the suggested disable/enable index method. </P> <P>Splunk 7.2.3 (build 06d57c595b80)</P> <PRE><CODE> Repair entire bucket, index=cylo, tryWarmThenCold=0, bucket=/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652, exists=1, localrc=3, failReason=(entire bucket) Rebuild for bkt='/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652' failed: Error reading rawdata at offset=17870904: rawdata was truncated </CODE></PRE> Wed, 20 Feb 2019 15:27:37 GMT stanwin 2019-02-20T15:27:37Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-fix-Bucket-corruption-rawdata-was-truncated/m-p/392403#M70106 <P>Hiya Bucketheads</P> <P>after running rebuild on a index, quite a lot of buckets were not fixed with below reason. </P> <PRE><CODE> failed: Error reading rawdata at offset=xxxxxx : rawdata was truncated </CODE></PRE> <P>What is the cause of this problem .</P> <P>Can those buckets be fixed at all ? The rebuild process was not successful so I have doubts?</P> <P>we have previously tried the suggested disable/enable index method. </P> <P>Splunk 7.2.3 (build 06d57c595b80)</P> <PRE><CODE> Repair entire bucket, index=cylo, tryWarmThenCold=0, bucket=/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652, exists=1, localrc=3, failReason=(entire bucket) Rebuild for bkt='/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652' failed: Error reading rawdata at offset=17870904: rawdata was truncated </CODE></PRE> Wed, 20 Feb 2019 15:27:37 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-fix-Bucket-corruption-rawdata-was-truncated/m-p/392403#M70106 stanwin 2019-02-20T15:27:37Z