topic Re: ERROR DistBundleRestHandler - Problem untarring file in Monitoring Splunk

ERROR DistBundleRestHandler - Problem untarring file

clocker_splunk — Thu, 21 Feb 2013 16:34:12 GMT

Running 5.0.1 on Linux, receiving this error over 500 times a day spread across 34 indexers. Using the splunk service account, I was able to untar the the bundle fine so I do not believe it's permission based. Any suggestions on how to resolve the error? I've posted more warnings around the error below:

splunkd.log.5:02-10-2013 19:40:16.107 +0000 ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/82C8F892-6A60-451B-9E7B-012BC192118F-1360524901.bundle
splunkd.log.5:02-10-2013 20:06:22.449 +0000 WARN DistBundleRestHandler - There was a problem renaming: /opt/splunk/var/run/searchpeers/82C8F892-6A60-451B-9E7B-012BC192118F-1360526701.tmp -> /opt/splunk/var/run/searchpeers/82C8F892-6A60-451B-9E7B-012BC192118F-1360526701: Directory not empty
splunkd.log.5:02-10-2013 20:06:22.449 +0000 ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/82C8F892-6A60-451B-9E7B-012BC192118F-1360526701.bundle
splunkd.log.5:02-10-2013 20:30:14.185 +0000 WARN DistBundleRestHandler - Removed pre-existing temporary directory for untar: /opt/splunk/var/run/searchpeers/DCC02B2A-C40A-41C1-BD92-434A555088B9-1360352701.tmp
splunkd.log.5:02-10-2013 20:30:14.505 +0000 WARN DistBundleRestHandler - There was a problem renaming: /opt/splunk/var/run/searchpeers/DCC02B2A-C40A-41C1-BD92-434A555088B9-1360352701.tmp -> /opt/splunk/var/run/searchpeers/DCC02B2A-C40A-41C1-BD92-434A555088B9-1360352701: Directory not empty
splunkd.log.5:02-10-2013 20:30:14.505 +0000 ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/DCC02B2A-C40A-41C1-BD92-434A555088B9-1360352701.bundle

Re: ERROR DistBundleRestHandler - Problem untarring file

rmcdougal — Tue, 02 Apr 2013 20:18:24 GMT

Did you ever figure out the solution to this issue? I am experiencing the same issues myself.

Re: ERROR DistBundleRestHandler - Problem untarring file

clocker_splunk — Tue, 09 Apr 2013 19:02:21 GMT

This is a verified bug SPL-62238. The fix will be resolved in v5.0.4.

Re: ERROR DistBundleRestHandler - Problem untarring file

lmyrefelt — Thu, 18 Jul 2013 14:37:10 GMT

when can we expect to be able to download 5.0.4 ? 🙂

Re: ERROR DistBundleRestHandler - Problem untarring file

ctux — Fri, 09 Aug 2013 07:47:48 GMT

I'm experiencing the same issue.
I did upgrade to version 5.0.4 but the problem persists...

How to check status of bug SPL-62238?

Re: ERROR DistBundleRestHandler - Problem untarring file

sdwilkerson — Tue, 27 Aug 2013 18:24:13 GMT

I'm seeing still seeing the same issue with 5.0.4 as well. Any updates?

Re: ERROR DistBundleRestHandler - Problem untarring file

sdwilkerson — Tue, 24 Sep 2013 21:17:49 GMT

Ping! Any updates?

Re: ERROR DistBundleRestHandler - Problem untarring file

ewoo — Tue, 24 Sep 2013 21:21:56 GMT

The fix is going to land in a future 5.0.x maintenance release. It didn't really land in 5.0.4.

Re: ERROR DistBundleRestHandler - Problem untarring file

adylent — Wed, 23 Oct 2013 21:57:20 GMT

I'm seeing this same issue on 6.0. Did you ever resolve it?

Re: ERROR DistBundleRestHandler - Problem untarring file

ewoo — Wed, 23 Oct 2013 22:07:44 GMT

The fix is going to land in future 5.0.x and 6.0.x maintenance releases.

Re: ERROR DistBundleRestHandler - Problem untarring file

ewoo — Wed, 23 Oct 2013 22:14:06 GMT

Bundle replication failures can happen for a variety of reasons. That being said, the ERROR messages here implicate SPL-60740/SPL-74416 as a possible cause -- Splunk instances in a search head pool, under certain conditions, attempt to perform replications that have already completed in the past. This then causes "collisions" with the pre-existing bundles on the indexer.

The fix for this bug will land in future 5.0.x and 6.0.x maintenance releases.

Re: ERROR DistBundleRestHandler - Problem untarring file

ctux — Thu, 24 Oct 2013 07:12:09 GMT

mmmm...
Waiting mode: on
:)

Re: ERROR DistBundleRestHandler - Problem untarring file

michaeloleary — Wed, 13 Nov 2013 08:19:27 GMT

I too am seeing this issue, however I don't see this on the known issues list in 5.0.4

Re: ERROR DistBundleRestHandler - Problem untarring file

rphillips_splk — Tue, 10 Mar 2015 22:50:47 GMT

encountered these same error messages "Problem untarring file: " and "Directory not empty" in a 6.1.3 release:

SPLUNK VERSION:
VERSION=6.1.3
BUILD=220630
PRODUCT=splunk
PLATFORM=Linux-x86_64

http://answers.splunk.com/answers/221340/warn-streamedsearch-could-not-find-bundles-for-sea.html#answer-222344

Re: ERROR DistBundleRestHandler - Problem untarring file

krish3 — Thu, 28 Jan 2016 10:40:59 GMT

I am facing the same issue on 6.3.2 😞

Any work around?

Re: ERROR DistBundleRestHandler - Problem untarring file

esalesapns2 — Tue, 21 May 2019 11:59:23 GMT

I'm having the same problem between my deployment server and index cluster. If I remove all the files and directories starting with my deployment server's name from $SPLUNK_HOME/var/run/searchpeers it recovers with no need to restart,

Splunk 7.0.3 (build fa31da744b51).