Archive

Could not read event. Results may be incomplete

Explorer

Hello, I am seeing the following error while running Splunk search.

"idx=##INDEX NAME HERE## Could not read event: cd=0:33610. Results may be incomplete ! (logging only the first such error; enable DEBUG to see the rest)"

Any idea why it might be happening? How can I search more logging for this error.

Tags (1)

Path Finder

I'm seeing a similar error. How would one ID the bucket that is a problem? What component should I put into Debug ?

0 Karma

Communicator

Here's what i used-- kudos to splunk support for that one:
Ensure that you've got $SPLUNKDB set in your environment (source $SPLUNKHOME/bin/setSplunkEnv):

find $SPLUNKDB -type f -wholename '*/db/[dr]b*/rawdata/journal.gz' | perl -ne 'chomp;$d=$;$d=~s/journal.gz$//;if(-e "$d/slicesv2.dat"){@s=splunk cmd splunkd slices-dat-util --print \Q$d\E;if(${^CHILDERRORNATIVE}){print STDERR "Error processing $d\n"}elsif($s[$#s]!~/\d+:(?:\s+\d+){2}\s+(\d+)/){print STDERR "Error parsing results from $d\n"}else{print "$d\n" if $1 >= ((stat "$")[7])}}'

cheers

0 Karma

Path Finder

Try to stop the indexer and do a rebuild on the bucket. Therefore sometimes even if the rebuild seems successful the bucket is still corrupted (7.0.1)

0 Karma

Engager

I am also seeing this for the internal index: [indexer] idx=internal Could not read event: cd=(n/a). Results may be incomplete !

0 Karma

Path Finder

The "Could not read event: cd=(n/a)" bug has been fixed in 7.0.1

0 Karma