Getting Data In

rawdata error

selvarn
New Member

I upgraded splunk from 4.0.3 to 4.3.3, After upgrade, i started the splunkd service and could found error in splunkd.log file.

  1. 07-11-2012 14:57:46.952 +0530 ERROR ProcessTracker - (child_2__Fsck) BucketBuilder - The rawdata version in directory "/opt/splunk/var/lib/splunk/audit/db/db_1339419362_1339419301_19/rawdata" does not support rebuilding

Can someone give suggestion/solution to resolve the problem?

Tags (1)
0 Karma

Drainy
Champion

What order did you process the upgrade in? Did you go directly from 4.0 to 4.3?

I don't think its anything to worry about, FSCK doesn't support buckets created in pre.. 4.1 or 4.2 ? one of those anyway. So it is fairly normal to see that message, it could also be indicative of an upgrade from 4.0 direct to 4.3.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...