We've been seeing the same error as originally mentioned in this older question:
http://answers.splunk.com/questions/11607/4-1-7-upgrade-from-4-1-4-new-error-message-failed-to-rm-di...
Haven't seen any further insight from anyone at Splunk on this, was just wondering if any conclusion was ever reached as to the cause of this error. To be specific, we're seeing lines like the following after nearly every search that's executed (note: the searched finish fine in the interface, and, at least in the web gui, everything seems normal):
03-29-2011 22:26:44.014 ERROR Timeliner - Failed to rm dir /opt/splunk/var/run/splunk/dispatch/searchparsetmp_607175023/buckets: No such file or directory
Going by the advice in the aforementioned question, we've confirmed that all necessary ownership and permissions are set properly all the way through to (and including) the "dispatch" directory. Likewise, the directories mentioned in these messages are being removed properly after the searches finish their natural lifespan. I'm not sure what's causing the generation of these errors from the "Timeliner". It's as if it isn't aware that the searches are completing properly, and is trying to cleanup the directories after the fact.
Any insight or suggestions on further debugging this would be greatly appreciated.
