Getting Data In

Splunk UF crashing frequently 6.3


Hi All,

UF is crashing frequently . I didn't find any details in the splunkd logs


Splunk Error Log:
splunkd: /home/build/build-src/ember/src/pipeline/input/Tailing.h:178: bool StatWrap::isDir() const: Assertion _valid' failed.
2016-09-19 07:10:30.089 +0200 splunkd started (build aa7d4b1ccb80)
splunkd: /home/build/build-src/ember/src/pipeline/input/Tailing.h:178: bool StatWrap::isDir() const: Assertion
_valid' failed.
2016-10-03 08:00:18.048 +0200 splunkd started (build aa7d4b1ccb80)
splunkd: /home/build/build-src/ember/src/pipeline/input/Tailing.h:178: bool StatWrap::isDir() const: Assertion `_valid' failed.
2016-10-17 19:22:31.964 +0200 splunkd started (build aa7d4b1ccb80)

Sathish Rangan

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

2015-11-04 SPL-104078, SPL-104017 Splunkd crash due to assertion failure in Tailing.

This appears to be the same issue and is fixed in 6.3.1

I would suggest you upgrade.


When you hit an assertion or other crash condition, and you are running on something that is not the latest patch level for the release you are on - update first, then seek help from the community and/or support. There have been 8 public releases of Splunk 6.3 over the last year since Splunk 6.3.0 originally dropped.. Currently Splunk 6.3.8 is the latest, and the change logs ( show it has dozens of fixes put in cumulatively to solve issues found.

The community is glad to help, but make sure you make the most of other people's time they contribute by attempting the easy fixes like upgrading first.

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...