Getting Data In

rawdata error

New Member

I upgraded splunk from 4.0.3 to 4.3.3, After upgrade, i started the splunkd service and could found error in splunkd.log file.

  1. 07-11-2012 14:57:46.952 +0530 ERROR ProcessTracker - (child_2__Fsck) BucketBuilder - The rawdata version in directory "/opt/splunk/var/lib/splunk/audit/db/db_1339419362_1339419301_19/rawdata" does not support rebuilding

Can someone give suggestion/solution to resolve the problem?

Tags (1)
0 Karma


What order did you process the upgrade in? Did you go directly from 4.0 to 4.3?

I don't think its anything to worry about, FSCK doesn't support buckets created in pre.. 4.1 or 4.2 ? one of those anyway. So it is fairly normal to see that message, it could also be indicative of an upgrade from 4.0 direct to 4.3.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...