rawdata error

[selvarn]

I upgraded splunk from 4.0.3 to 4.3.3, After upgrade, i started the splunkd service and could found error in splunkd.log file.

1. 07-11-2012 14:57:46.952 +0530 ERROR ProcessTracker - (child_2__Fsck) BucketBuilder - The rawdata version in directory "/opt/splunk/var/lib/splunk/audit/db/db_1339419362_1339419301_19/rawdata" does not support rebuilding

Can someone give suggestion/solution to resolve the problem?

[Drainy]

What order did you process the upgrade in? Did you go directly from 4.0 to 4.3?

I don't think its anything to worry about, FSCK doesn't support buckets created in pre.. 4.1 or 4.2 ? one of those anyway. So it is fairly normal to see that message, it could also be indicative of an upgrade from 4.0 direct to 4.3.