topic Re: Fatal MetaData message re: sources.data in splunkd.log in Splunk Search

Fatal MetaData message re: sources.data in splunkd.log

Jaci — Thu, 02 Sep 2010 05:37:47 GMT

I'm getting this error in splunkd.log on Windows 7

What does this mean and how can it be corrected?

08-15-2010 05:18:01.854 FATAL MetaData - failed to rename D:\SPLUNK\var\lib\splunk\defaultdb\db\Sources.data.temp to D:\SPLUNK\var\lib\splunk\defaultdb\db\Sources.data: Access is denied.

There is no Sources.data.temp file in the directory

Re: Fatal MetaData message re: sources.data in splunkd.log

hexx — Thu, 02 Sep 2010 07:19:18 GMT

I suspect a permissions issue.

When you login as the user that splunkd runs as and you attempt to create a new file in D:\SPLUNK\var\lib\splunk\defaultdb\ , do you get an error or are you prompted for the need to be admin to make the change?

Re: Fatal MetaData message re: sources.data in splunkd.log

Arseny — Thu, 02 Jun 2011 14:10:27 GMT

Experiencing the same issue on win2003 x64. However there is such file and permissions are ok. Any ideas? Search over the problematic index is very slow.