Error message when creating a diag file

[jrsanders]

Hello All,

I'm receiving the following error when I try to create a diag file;

./splunk diag
Collecting components: app:splunk_app_db_connect, conf_replication_summary, consensus, dispatch, etc, file_validate, index_files, index_listing, kvstore, log, pool, searchpeers
Skipping components: rest
Selected diag name of: diag-pel501.mascocs.com-2017-09-19_12-51-02
Starting splunk diag...
Logged search filtering is enabled.
Skipping REST endpoint gathering...
Determining diag-launching user...
Getting version info...
Getting system version info...
Getting file integrity info...
Getting network interface config info...
Getting splunk processes info...
Getting netstat output...
Getting info about memory, ulimits, cpu (on windows this takes a while)...
Getting etc/auth filenames...
Getting Sinkhole filenames...
Getting search peer bundles listings...
Getting conf replication summary listings...
Getting KV Store listings...
Getting index listings...
Copying Splunk configuration files...
filtered out file '/opt/splunk/etc/apps/SA-VMW-HierarchyInventory/lookups/TimeVirtualMachinesOnDatastore.csv' limit: 10485760 size: 11582385
filtered out file '/opt/splunk/etc/apps/SA-EndpointProtection/lookups/localprocesses_tracker.csv' limit: 10485760 size: 1261901947
Exception occurred while generating diag, we are deeply sorry.
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 4573, in main
create_diag(options, log_buffer)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 4096, in create_diag
copy_etc(options)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 1939, in copy_etc
add_dir_to_diag(etc_dir, "etc", ignore=etc_filt)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 693, in add_dir_to_diag
storage.add_dir(dir_path, diag_path, ignore=ignore)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 488, in add_dir
collect_tree(dir_path, diag_path, adder, ignore=ignore)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3069, in collect_tree
collect_tree(srcname, dstname, actor, ignore)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3069, in collect_tree
collect_tree(srcname, dstname, actor, ignore)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3069, in collect_tree
collect_tree(srcname, dstname, actor, ignore)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3072, in collect_tree
actor(srcname, dstname)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 649, in add_file_to_diag
add_fake_special_file_to_diag(file_path, diag_path, special_type)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 625, in add_fake_special_file_to_diag
storage.add_fake_file(file_path, name)
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 506, in add_fake_file
tinfo.size = 0
AttributeError: 'NoneType' object has no attribute 'size'

Diag failure, writing out logged messages to '/tmp/diag-fail-TUZmYc.txt', please send output + this file to either an existing or new case ; http://www.splunk.com/support
We will now try to clean out any temporary files...

Has anyone seen this error before?

[saravanan90]

Try running the below python script directly for diag.

./splunk cmd python $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib/info_gather.py

[nmurillo_splunk]

Have you tried running a diag without the etc directory. This should help narrow down where the pythons script is having issues. Typically users have binaries files in the etc directory that will cause issues.

$SPLUNK_HOME/bin/splunk diag --disable=etc