Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- What is: ERROR BucketMover - sizeBytes=xxx candida...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got a lot of logged events in the _internal-index for one of our indexers. First we always see an event like this
02-24-2014 13:43:42.850 +0100 INFO BucketMover - will attempt to freeze: candidate='e:\splunk\indexes\test\db\db_1389020646_1383541534_0' because frozenTimePeriodInSecs=2592000 exceeds difference between now=1393245822 and latest=1389020646
Then immediately we get an error event like this
02-24-2014 13:43:42.850 +0100 ERROR BucketMover - sizeBytes=176128 candidateBytes=253952
24 events the last 15 minutes, and they keep coming.
Searchhead and indexers on Windows 2012, Splunk 6.0.1 (build 189883)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This looks like a known issue fixed in 6.1.4. SPL-86189
http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This looks like a known issue fixed in 6.1.4. SPL-86189
http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did update on 1'st of October to 6.1.4, no errors seen since then.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2,018 events (08/09/2014 00:00:00.000 to 08/09/2014 21:41:16.000)
So...no, still an issue
Now using Splunk 6.1.3 build 220630
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Still no help on this? I am seeing this same issue, also getting authentication errors/timeouts on search peers periodically. Thought it had to do with too many search jobs, but ruled that out when I disabled everything.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
93 events last 60 minutes, so sorry - still an issue here as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any update on this? Seeing it on linux too
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Now running Splunk 6.1.1 build 207789, still same issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Checked just now, 1048 events so far today, 5 on one of the indexers, the rest shared on the searchhead and the second indexer, so still an issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have also got a ton of this error.
Could anyone please throw some light on this error?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
