topic Re: ERROR BucketMover in Monitoring Splunk

ERROR BucketMover

abhayneilam — Mon, 28 Sep 2020 17:09:32 GMT

Hi, I am getting the below error in splunkd.log :

07-24-2014 01:30:51.609 +0200 INFO BucketMover - will attempt to freeze: candidate='/opt/SP/apps/splunk/splunk-6.0.1/var/lib/splunk/rest/db/db_1392823223_1392819715_1' because

frozenTimePeriodInSecs=2419200 exceeds difference between now=1406158251 and latest=1392823223
07-24-2014 01:30:51.664 +0200 ERROR BucketMover - sizeBytes=12288 candidateBytes=19456
07-24-2014 01:30:51.760 +0200 ERROR BucketMover - sizeBytes=1486336 candidateBytes=1574400

Please let me know how to solve this one !!

Re: ERROR BucketMover

abhayneilam — Wed, 23 Jul 2014 23:46:02 GMT

After some time in the search head UI it is showing :

Splunkd daemon is not responding: ('Error connecting to /servicesNS/name.title%40xxx.com/apix/search/jobs: The read operation timed out',)

Re: ERROR BucketMover

vhallan_splunk — Fri, 05 Sep 2014 11:15:22 GMT

This issue has been fixed in 6.0.6 and planned to be fixed in 6.1.4. The problem is that the bucket is attempting to freeze and due to an error the bucket does not role to frozen. Workaround is to delete/move the bucket manually.