Archive

Splunk Index has Stopped Updating

johnpatrick27
New Member

Hi,

My index has stopped updating for more than a month now. All other indexes I've created in the past are perfectly working but this one. I went to _internal index to see if there are any errors and seeing multiple errors related to TailReader, ExecProcessor, FrameworkUtils. Could anyone confirm if these errors are the culprit for my index to not update, and if so, how could I fix them? I am using Splunk Web. TIA.

5/13/18
6:08:19.685 AM

05-13-2018 06:08:19.685 -0400 WARN TailReader - Access error while handling path: failed to open for checksum: '/export/splunk/var/log/splunk/dbx2.log.rotate.63202366' (No such file or directory)
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM

05-11-2018 15:20:51.091 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM

05-11-2018 15:20:51.091 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM

05-11-2018 15:20:51.061 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM

05-11-2018 15:20:51.061 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Is that index being filled using DB Connect?

0 Karma

johnpatrick27
New Member

Yes, it is being filled using DB Connect.

0 Karma

xpac
SplunkTrust
SplunkTrust

Do you have any other indexes that are being filled by DBConnect?
The error messages you posted do not look like any kind of index problem, but they point to errors in your DB Connect input. I guess this is a Windows installation?

0 Karma

johnpatrick27
New Member

Yes, there are actually a number of indexes I created and all of them are working except this one. It was working ever since I created it until last month. I didn't have any configuration changes so it is really baffling me. I am not sure if Windows installation is applicable to me, I am only accessing Splunk in web.

0 Karma