I have a continuous repeat of the follow error in my splunkd.log:
ERROR BTreeCP - failed: failed to copy/move C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db\btree_index.dat to C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db\snapshot.tmp: The system cannot find the path specified.
What is the btree_index.dat and what are the implications of its failure to be copied as snapshot.tmp?
To an answer an ancient question (found it searching) this is a failure to create a backup.
The BTree is where Splunk records the file pointers, or bookmarks, of how far into various files with various content signatures we read, so that we only get new data from files.
Periodically we back this two-file database up into the snaphot subdirectory, and this is a part of that process.
If we goofed once along these lines, it is not a lot to worry about. Probably there was some concurrency error, but it just means once we missed one chance to make a backup. If this is happening all the time, it means you are more exposed to scenarios where the file might become damaged.
In practice, we haven't had these scenarios occur to my knowledge, this is just defensive programming. Still, if this happens all the time, we should look into it.
To an answer an ancient question (found it searching) this is a failure to create a backup.
The BTree is where Splunk records the file pointers, or bookmarks, of how far into various files with various content signatures we read, so that we only get new data from files.
Periodically we back this two-file database up into the snaphot subdirectory, and this is a part of that process.
If we goofed once along these lines, it is not a lot to worry about. Probably there was some concurrency error, but it just means once we missed one chance to make a backup. If this is happening all the time, it means you are more exposed to scenarios where the file might become damaged.
In practice, we haven't had these scenarios occur to my knowledge, this is just defensive programming. Still, if this happens all the time, we should look into it.
I should wait until 2014, but can't help myself. You're welcome!
ancient answer to ancient question now accepted! thanks!