Error in 'databasePartitionPolicy': Failed to read 1 event(s) from rawdata from bucket 'main-112-C7BC880D-F64C-B288-6A8FF984920D',Rawdata ma be corrupt,see search.log

New Member

Hii All , I need your help to resolve this issue , I am encountering the above mentioned error and subsequently i was not able to pull and eventlog (data) , how can i resolve this issue ? what is the search.log ? where is this stored on the PC ?

Thanks a lot for your help and advice , Much appreciated 🙂

Tags (1)
0 Karma


What version of Splunk are you using? BTW- Is it a VMware or virtual system? I am experiencing something similar with a VMware Splunk server.
splunk stop splunkd
/opt/splunk/bin/./splunk fsck --all --repair
splunk start splunkd
The other option would be to Clean the indexes and start over with a new index.

Hope that helps!

0 Karma