topic Re: successful summary search but no data in the summary index in Knowledge Management

successful summary search but no data in the summary index

paranoid — Mon, 28 Sep 2020 12:54:44 GMT

An hourly scheduled summary search finishes successfully:

12-05-2012 05:17:27.966 +0000 INFO SavedSplunker - savedsearch_id="nobody;XXX;Summary Gen", user="nobody", app="XXX", savedsearch_name="Summary Gen", status=success, digest_mode=1, scheduled_time=1354684620, dispatch_time=1354684644, run_time=3.788, result_count=18244, alert_actions="summary_index", sid="scheduler_nobody_ZW1haWxfbWV0cmljc19hcHA_RMD59f64bf9adfa139f1_at_1354684620_60d34ceed7aa64ec", suppressed=0, thread_id="AlertNotifierWorker-0"

search.log in the dispatch directory has this error
12-05-2012 05:17:27.748 ERROR SummaryIndexProcessor - Error moving file '/var/groupon/splunk/var/run/splunk/1354684647.1.tmp' to '/var/groupon/splunk/var/spool/splunk/RMD59f64bf9adfa139f1_1502598233.stash_new'.

As a result the data doesn't arrive in the summary index. Also interesting that the scheduled search is considered successful

What does this error mean? There is plenty of free disk space.

Re: successful summary search but no data in the summary index

dart — Wed, 05 Dec 2012 18:16:02 GMT

The error means that the results file /var/groupon/splunk/var/run/splunk/1354684647.1.tmp could not be moved into the spool directory /var/groupon/splunk/var/spool/splunk which is where it would be picked up to be indexed, which has a sinkhole (delete after indexing) input set up.

Double check the permissions of the folder /var/groupon/splunk/var/spool/splunk. Is it on the same volume as the rest of Splunk or a different one? Are there any files in /var/groupon/splunk/var/spool/splunk?

Re: successful summary search but no data in the summary index

paranoid — Wed, 05 Dec 2012 18:33:25 GMT

The scheduled search works most of the time, so it's not permissions. /var/groupon/splunk/var/spool/splunk has quite a few files, will a name collision explain this?

And then I guess the next question is, why are there so many files there? Files should only live there for the duration of indexing. Some files are fra mid November and we are early December now.