topic ERROR KVStorageProvider - Operation createIndex - Cannot index parallel arrays in Knowledge Management

ERROR KVStorageProvider - Operation createIndex - Cannot index parallel arrays

faguilar — Fri, 15 Jun 2018 09:14:01 GMT

Hi,

I'm working with a distributed Splunk 6.3.1 architecture with:

1 SH
1 IDX
1 HF

And since one day I'm receiving this error message (which is replicating each second on splunk.log):

06-15-2018 11:06:22.950 +0200 ERROR KVStorageProvider - An error occurred during the last operation ('createIndex', domain: '5', code: '10088'): exception: cannot index parallel arrays [area] [group]

Since that day, none of my custom Splunk apps work because the mongo service is down, and I'm receiving this message when I execute an | inputlookup:

Error in 'inputlookup' command: External command based lookup 'kvstore_mykvstore' is not available because KV Store initialization has failed. Please contact your system administrator.

Does anybody knows what is happening here or where can I found more information about this problem? In splunk.log I'm only seeing the KVStorageProvider error, and I don't know where or how I can solve this.

Thank you very much!

Re: ERROR KVStorageProvider - Operation createIndex - Cannot index parallel arrays

Sukisen1981 — Fri, 15 Jun 2018 10:09:09 GMT

Hi, You mentioned that you are probably using mongodb app.
It looks like an issue with Mongodb per se and not Splunk perhaps.
Check out this below stack link - is this issue similar?
https://stackoverflow.com/questions/25059525/indexing-parallel-arrays-in-mongodb

Re: ERROR KVStorageProvider - Operation createIndex - Cannot index parallel arrays

onthebay — Wed, 10 Jul 2019 20:47:55 GMT

We had a similar and ended up separating the combined accelerated_fields into two separate entries.

Our researched showed that these fields has a few multi-valued entries which we believe mongo saves as arrays thus causing the issue,Check if either of the fields in the KV are multi-valued. We believe that a MV field cannot be part of a multi-part accelerated field (mongo index)