topic Re: Getting this error - then Splunkd crashes.. in Monitoring Splunk

Getting this error - then Splunkd crashes..

edenzler — Thu, 01 Aug 2013 18:16:36 GMT

Error in 'databasePartitionPolicy': Failed to read 1 event(s) from rawdata in bucket '_internal~235~8AD95516-6DE5-4CCF-82AA-19FD5902414E'. Rawdata may be corrupt, see search.log

I poked around here, just want to be sure that whatever I do doesn't destroy my instance.

Any direction/suggestions would be greatly appreciated.

Cheers,

Re: Getting this error - then Splunkd crashes..

lukejadamec — Thu, 01 Aug 2013 18:37:21 GMT

It looks like you have a corrupt index (_internal).
You can run this command to check the index:

To check the metadata use this.

$SPLUNK/bin/splunk stop

$SPLUNK/bin/splunk cmd splunkd fsck --index _internal

To repair the metadata use this.

$SPLUNK/bin/splunk stop

$SPLUNK/bin/splunk cmd splunkd fsck --index _internal --mode metadata --repair

To rebuild the bucket use this.

$SPLUNK/bin/splunk stop

$SPLUNK/bin/splunk rebuild $SPLUNK/bin/splunk rebuild $SPLUNK/bin/splunk/var/lib/splunk/_internal/pathtobadbucket

Here is a link to a page that describes how to go about repairing indexes.
http://wiki.splunk.com/Check_and_Repair_Metadata

Re: Getting this error - then Splunkd crashes..

lmyrefelt — Tue, 11 Feb 2014 10:09:03 GMT

check also here for more / additional help / solution;

http://answers.splunk.com/answers/80882/corrupted-bucket-journal