Deployment Architecture

Splunk stopped index. what is hot_v1_ID

moon92
New Member

Splunk stopped indexing when it sent message in splunkd.log

" WARN DatabaseDirectoryManager - Failed getting size of path='/splunk/splunk/var/lib/splunk/audit/db/hot_v1_592/1470663602-1470663601-4147689500280802279.tsidx.lock':No such file or directory "

What is the problem, and why?

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi moon92,

those are the hot buckets of your Splunk instance, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/HowSplunkstoresindexes#Bucket_names

Check for other errors before this message and check maybe your disk space usage. The is a default limit in server.conf of 5000mb, see docs for more details http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Serverconf#Disk_usage_settings_.28for_the_in...

Beside this, it's hard to provide additional help based on the provided information.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...