Archive

ERROR WordPositionData - couldn't parse hash code:

Explorer

I had a power outage on my system and upon restoring, I now get this in the splunkd.log and the splunkd service will not start:

ERROR WordPositionData - couldn't parse hash code:

I've found a previous posting where Simeon mentions one could move the "index" files and then have it rebuild for new data. What and where are these files that can be moved so I can get up and running again?

Below is that link.

Thanks!

http://answers.splunk.com/questions/3811/error-wordpositiondata-couldnt-parse-hash-code-spl-31080

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

The presence of "ERROR WordPositionData - couldn't parse hash code:" messages in splunkd.log often indicates an inconsistency in one of the metadata files (Hosts.data, Sources.data, SourceTypes.data) located in the hot/warm index repository (Example for the main index : $SPLUNK_DB/defaultdb/db/) or in one of the buckets (usually one of the hot ones) contained in that index.

To fix this, the first thing to do is to identify which metadata file(s) has/have inconsistencies.

To that effect, the following command has to be run for the incriminated index (check splunkd.log, it's the index that was just being opened before splunkd crashed) and for all of it's hot/warm buckets :

$SPLUNK_HOME/bin/recover-metadata {path_to_index|path_to_bucket} --validate

For a given index, I like to run the two commands below to check the metadata files at the root of the hot/warm db first, and then each bucket using the list from .bucketManifest :

$SPLUNK_HOME/bin/recover-metadata $SPLUNK_DB/{index_name}/db/ --validate

for i in 'cat $SPLUNK_DB/{index_name}/db/.bucketManifest | cut -f3 -d " "'; do $SPLUNK_HOME/bin/recover-metadata $SPLUNK_DB/{index_name}/db/$i ; done

Each time an error is reported, the corresponding .data file should be deleted. Once all corrupted metadata files have been removed, the check should be run again. It will indicate errors for those files because they can't be found, but Splunk should be now ready to start.

Repeat the operation for each index for which splunkd.log reports this type of error.

Super Champion

You index files are (by default) under your spunk install. The path should look something like this:

$SPLUNK_HOME/var/lib/splunk/<index_name>

Hmm. There are a few more things I could say bout this, but borrowing from Simeon's answer... I'm also going to suggest that you contact splunk support. You can submit a high-priority case online, and then call Splunk's support line and talk to someone about your case.

0 Karma

Splunk Employee
Splunk Employee

In a case like that (no need to keep the indexed information), you can also just go ahead and wipe your indexes with :

$SPLUNK_HOME/bin/splunk clean all

0 Karma

Super Champion

Generally it's better to move them; but if you'r just demoing the software then it probably doesn't matter.

0 Karma

Explorer

Thanks for the response. I found those various folders but wasn't sure if I could actually "delete" the folders completely and it would restart. I just ended up uninstalling and re-installing. As far as support goes, this is just a trial for me, so I don't think I have support.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!