Getting Data In

BucketMover moving to cold on UNC

jrich523
Path Finder

I get the following error:

ERROR BucketMover - aborting move because recursive copy from src='C:\Program Files\Splunk\var\lib\splunk\f5test\warmdb\db_1380909713_1380904989_18' to dst='\10.20.120.120\Splunk\Node01\F5test\inflight-db_1380909713_1380904989_18' failed (reason='The operation completed successfully.')

I is indication successful but i check the folder and there is nothing there.

I logged in to the server (windows 2012 R2) as the service account that runs splunkd and checked to make sure access was ok and im able to create/read/write ok. Also it created the F5Test folder when i added the cold path to the index so its not an access issue.

I ran procmon to see if it showed anything and I can see it trying to access the path

1:42:54.2746637 PM splunkd.exe 1684 CreateFile \10.20.120.120\splunk\Node01\F5test\inflight-db_1380909713_1380904989_18 NAME NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

So that seems normal, based on the fact that the file isnt there and it should be the Copy (CreateFile is used for a lot of things)

Is there something else i can do to look at why this might not be working?

thanks

0 Karma
1 Solution

jrich523
Path Finder

one part I left out, that was important to solving this was that i had moved the Warm files previously and it had screwed up the permissions so the problem was i didnt have access to move the local files. reset permissions and things started to move.

View solution in original post

jrich523
Path Finder

one part I left out, that was important to solving this was that i had moved the Warm files previously and it had screwed up the permissions so the problem was i didnt have access to move the local files. reset permissions and things started to move.

Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...