Getting Data In
Highlighted

Error message is displayed when I rebuild archive data.

Builder

When I rebuild archive data, ERROR message is displayed like below.

ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to check if idx= is an index with a remote storage, but that index does not exist on the system or is disabled

However, the rebuilt data will be displayed normally as a result when I search it.

What is this message?
My index data is not under the default "SPLUNK_HOME/var/lib/splunk/", but it is placed under "/data" which is another partition.
Is it related to this "ERROR"?

Highlighted

Re: Error message is displayed when I rebuild archive data.

SplunkTrust
SplunkTrust

does that index exist on your system where you are archiving the data?

0 Karma
Highlighted

Re: Error message is displayed when I rebuild archive data.

Builder

Index folder including "thaweddb" and frozen path storing archive data is under "/data" which is a different partition, not "SPLUNKHOME/var/lib/splunk/".

The index that used to rebuild the archive data is under "/data" too.

0 Karma
Highlighted

Re: Error message is displayed when I rebuild archive data.

SplunkTrust
SplunkTrust

not the index folder i am talking about the index that you configure in local/indexes.conf

0 Karma
Highlighted

Re: Error message is displayed when I rebuild archive data.

Builder

Yeah! It certainly exists.

Because I can specify the index and retrieve the rebuilt data on SPL like below.
search index=... |

0 Karma
Highlighted

Re: Error message is displayed when I rebuild archive data.

Communicator

Hi Yutaka

Have you modified your SPUNK_DB Variable in the ~/etc/splunk-launch.conf Conffile?
Normaly it is not set, so the default path is taken.

# By default, Splunk stores its indexes under SPLUNK_HOME in the
# var/lib/splunk subdirectory.  This can be overridden
# here:
#
# SPLUNK_DB=/home/build/build-home/ember/var/lib/splunk
SPLUNK_DB=/some/path
0 Karma
Highlighted

Re: Error message is displayed when I rebuild archive data.

Builder

Thank you for answer Elsurion!

Yes I haven't modified "SPLUNKDB" variable.
But I don't use $SPLUNK
DB$ in indexes.conf.

I configured like below in indexes.conf.

coldPath = /data/lndexes/<index_name>/colddb
homePath = /data/lndexes/<index_name>/db
thawedPath =/data/lndexes/<index_name>/thaweddb
coldToFrozenDir =/data/Frozen/<index_name>
0 Karma
Highlighted

Re: Error message is displayed when I rebuild archive data.

Communicator

one other thing i have done on an installation is a symbolic link from the var/lib/splunk to the index folder. Might help.
link between ~/var/lib/splunk and /data/Indexes

0 Karma
Highlighted

Re: Error message is displayed when I rebuild archive data.

Builder

I think this may be bug of Splunk ver 6.6.4.

Because, just install Splunk 6.6.4,
The same error message appeared even if following steps were taken.

  1. Upload data that will be archived soon to index "test".

  2. Restart Splunk and archive the data.

3.Copy the archive data to $SPLUNK_DB/test/thaweddb and execute the following command.

/opt/splunk/bin/splunk rebuild db_1424259300_1424259300_1/

Then the following error appears.

ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to 
check if idx= is an index with a remote storage, but that index does not exist on the 
system or is disabled

indexes.conf

[test]
coldPath = $SPLUNK_DB/test/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test/thaweddb
bucketRebuildMemoryHint = 0
coldToFrozenDir = /opt/splunk/var/lib/splunk/frozen
compressRawdata = 1
enableOnlineBucketRepair = 1
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1
frozenTimePeriodInSecs = 10000

View solution in original post

Highlighted

Re: Error message is displayed when I rebuild archive data.

Builder

splunk support said this message can be ignored.