All Apps and Add-ons

VMWare app scheduled searches are crashing

dchodur
Path Finder

Has anyone seen where the VMWare app crashes at least once a min with having SA-VMW-HierarchyInventory enabled in the app. Here is the log off the dump. Did open a support case as well but thought I would ask here as well.


[build 123586] 2012-07-12 17:20:05
Access violation, cannot read at address [0x0000000000000040]
Exception address: [0x00000001403A5FB1]
Crashing thread: dispatch
MxCsr: [0x0000000000001FA0]
SegDs: [0x000000000000002B]
SegEs: [0x000000000000002B]
SegFs: [0x0000000000000053]
SegGs: [0x000000000000002B]
SegSs: [0x000000000000002B]
SegCs: [0x0000000000000033]
EFlags: [0x0000000000010206]
Rsp: [0x000000000230D480]
Rip: [0x00000001403A5FB1] ?
Dr0: [0x0000000000000000]
Dr1: [0x0000000000000000]
Dr2: [0x0000000000000000]
Dr3: [0x0000000000000000]
Dr6: [0x0000000000000000]
Dr7: [0x0000000000000000]
Rax: [0x000000000265A410]
Rcx: [0x0000000002948C10]
Rdx: [0x0000000000000000]
Rbx: [0x00000000029DFAB0]
Rbp: [0x0000000000000000]
Rsi: [0x0000000000000008]
Rdi: [0x000000000265A310]
R8: [0x0000000000000000]
R9: [0x0000000000000000]
R10: [0x0000000000000000]
R11: [0x0000000000000286]
R12: [0x000000000230D5B0]
R13: [0x000000000230DA38]
R14: [0x00000000029CBFD0]
R15: [0x000000000230D540]
DebugControl: [0x00000000710194D9]
LastBranchToRip: [0x0000000000000000]
LastBranchFromRip: [0x0000000000000000]
LastExceptionToRip: [0x0000000000000000]
LastExceptionFromRip: [0x0000000000000000]

OS: Windows
Arch: x86-64

Backtrace:
[0x00000001403A5FB1] ?
[0x00000001403B5FD2] ?
[0x0000000140440A98] ?
[0x0000000140441227] ?
[0x00000001403EFFBE] ?
[0x0000000140B3551A] ?
[0x0000000140B3F668] ?
[0x0000000140B44023] ?
[0x00000001408F1A82] ?
[0x0000000140004537] ?
[0x00000000736637D7] endthreadex + 71/272
[0x0000000073663894] endthreadex + 260/272
[0x0000000076B1652D] BaseThreadInitThunk + 13/96
[0x0000000076EFC521] RtlUserThreadStart + 33/1024
Crash dump written to: C:\Program Files\Splunk\var\log\splunk\C__Program Files_Splunk_bin_splunkd_exe_crash-2012-07-12-17-20-05.dmp

CHODURDJTEST /6.1 Service Pack 1
Threads running: 2
argv: [splunkd search --id=scheduler_admin_U0EtVk1XLUhpZXJhcmNoeUludmVudG9yeQ_TimeHierarchyClusterUpdate_at_1342131600_f123db188cccd28f --maxbuckets=0 --ttl=1200 --maxout=500000 --maxtime=8640000 --lookups=1 --reduce_freq=10 --user=admin --pro --roles=admin:power:user]
terminating...

1 Solution

hexx
Splunk Employee
Splunk Employee

It seems that you are hitting core Splunk bug SPL-53256, which is specific to Windows and causes searches to crash when they load empty file-based lookup tables. The searches of the VMWare app use and maintaining a lot of lookups which makes them prime candidates to trigger this bug.

This bug has been fixed in Splunk 4.3.4.

View solution in original post

hexx
Splunk Employee
Splunk Employee

It seems that you are hitting core Splunk bug SPL-53256, which is specific to Windows and causes searches to crash when they load empty file-based lookup tables. The searches of the VMWare app use and maintaining a lot of lookups which makes them prime candidates to trigger this bug.

This bug has been fixed in Splunk 4.3.4.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...