- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- What is: ERROR BucketMover - sizeBytes=xxx candida...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got a lot of logged events in the _internal-index for one of our indexers. First we always see an event like this
02-24-2014 13:43:42.850 +0100 INFO BucketMover - will attempt to freeze: candidate='e:\splunk\indexes\test\db\db_1389020646_1383541534_0' because frozenTimePeriodInSecs=2592000 exceeds difference between now=1393245822 and latest=1389020646
Then immediately we get an error event like this
02-24-2014 13:43:42.850 +0100 ERROR BucketMover - sizeBytes=176128 candidateBytes=253952
24 events the last 15 minutes, and they keep coming.
Searchhead and indexers on Windows 2012, Splunk 6.0.1 (build 189883)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This looks like a known issue fixed in 6.1.4. SPL-86189
http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This looks like a known issue fixed in 6.1.4. SPL-86189
http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did update on 1'st of October to 6.1.4, no errors seen since then.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2,018 events (08/09/2014 00:00:00.000 to 08/09/2014 21:41:16.000)
So...no, still an issue
Now using Splunk 6.1.3 build 220630
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Still no help on this? I am seeing this same issue, also getting authentication errors/timeouts on search peers periodically. Thought it had to do with too many search jobs, but ruled that out when I disabled everything.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
93 events last 60 minutes, so sorry - still an issue here as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any update on this? Seeing it on linux too
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Now running Splunk 6.1.1 build 207789, still same issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Checked just now, 1048 events so far today, 5 on one of the indexers, the rest shared on the searchhead and the second indexer, so still an issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have also got a ton of this error.
Could anyone please throw some light on this error?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
