i have installed Splunk 4.1.1. When i look at the -> Status -> Index Health page, i see there is this following warn comeing every 12 seconds:
04-26-2010 16:08:55.680 WARN timeinvertedIndex - splunk-optimize failed to start for index /opt/splunk/var/lib/splunk/fishbucket/db/db-hot
Is this a bug? And if not, what can i do about it?
Ok. So if it happens sporadic, it´s ok, if it´s happening quite often (in my case every 12 seconds...) it´s bad and i need to open a case with Splunk Support.
The splunk-optimize process can´t run on that subdirectory, since it doesn´t exist. Even if i create it manually, splunk-optimize won´t notice, except by creating another error:
05-11-2010 13:10:40.476 ERROR databasePartitionPolicy - Index is empty refusing to move. oldDirPath=/opt/splunk/splunk/var/lib/splunk/fishbucket/db/db-hot
The other message is still there:
05-11-2010 14:33:52.045 WARN timeinvertedIndex - splunk-optimize failed to start for index /opt/splunk/var/lib/splunk/fishbucket/db/db-hot
I filed a support case and since we have now Splunk 4.1.7 running i haven´t seen the message anymore.
Guess it got fixed.