Hiya Bucketheads
after running rebuild on a index, quite a lot of buckets were not fixed with below reason.
failed: Error reading rawdata at offset=xxxxxx : rawdata was truncated
What is the cause of this problem .
Can those buckets be fixed at all ? The rebuild process was not successful so I have doubts?
we have previously tried the suggested disable/enable index method.
Splunk 7.2.3 (build 06d57c595b80)
Repair entire bucket, index=cylo, tryWarmThenCold=0, bucket=/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652, exists=1, localrc=3, failReason=(entire bucket)
Rebuild for bkt='/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652' failed: Error reading rawdata at offset=17870904: rawdata was truncated
