Getting Data In

Unable to fix Bucket corruption : rawdata was truncated

stanwin
Contributor

Hiya Bucketheads

after running rebuild on a index, quite a lot of buckets were not fixed with below reason.

   failed: Error reading rawdata at offset=xxxxxx : rawdata was truncated

What is the cause of this problem .

Can those buckets be fixed at all ? The rebuild process was not successful so I have doubts?

we have previously tried the suggested disable/enable index method.

Splunk 7.2.3 (build 06d57c595b80)

    Repair entire bucket, index=cylo, tryWarmThenCold=0, bucket=/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652, exists=1, localrc=3, failReason=(entire bucket) 
 Rebuild for bkt='/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652' failed: Error reading rawdata at offset=17870904: rawdata was truncated
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...