Hello,
We had an index that stopped receiving logs. Since we do not manage the host sending the logs I wanted to get more information before reaching out. The one interesting error that showed up right about the time the logs stopped was the following. I have not been able to find anything useful about this type of error. Also the error is being thrown from the indexer.
Unable to read from raw size file="/mnt/splunkdb/<indexname>/db/hot_v1_57/.rawSize": Looks like the file is invalid.
thanks for any assistance I can get.
Hi @ITSplunk117,
it seems that you have son inconsitancy in data files.
Open a ticket to Splunk Support, sending them a diag of these indexer.
Ciao.
Giuseppe