ERROR WordPositionData - couldn't parse hash code:

[nate1]

I had a power outage on my system and upon restoring, I now get this in the splunkd.log and the splunkd service will not start:

ERROR WordPositionData - couldn't parse hash code:

I've found a previous posting where Simeon mentions one could move the "index" files and then have it rebuild for new data. What and where are these files that can be moved so I can get up and running again?

Below is that link.

Thanks!

http://answers.splunk.com/questions/3811/error-wordpositiondata-couldnt-parse-hash-code-spl-31080

[hexx]

The presence of "ERROR WordPositionData - couldn't parse hash code:" messages in splunkd.log often indicates an inconsistency in one of the metadata files (Hosts.data, Sources.data, SourceTypes.data) located in the hot/warm index repository (Example for the main index : $SPLUNK_DB/defaultdb/db/) or in one of the buckets (usually one of the hot ones) contained in that index.

To fix this, the first thing to do is to identify which metadata file(s) has/have inconsistencies.

To that effect, the following command has to be run for the incriminated index (check splunkd.log, it's the index that was just being opened before splunkd crashed) and for all of it's hot/warm buckets :

$SPLUNK_HOME/bin/recover-metadata {path_to_index|path_to_bucket} --validate

For a given index, I like to run the two commands below to check the metadata files at the root of the hot/warm db first, and then each bucket using the list from .bucketManifest :

$SPLUNK_HOME/bin/recover-metadata $SPLUNK_DB/{index_name}/db/ --validate

for i in 'cat $SPLUNK_DB/{index_name}/db/.bucketManifest | cut -f3 -d " "'; do $SPLUNK_HOME/bin/recover-metadata $SPLUNK_DB/{index_name}/db/$i ; done

Each time an error is reported, the corresponding .data file should be deleted. Once all corrupted metadata files have been removed, the check should be run again. It will indicate errors for those files because they can't be found, but Splunk should be now ready to start.

Repeat the operation for each index for which splunkd.log reports this type of error.

[Lowell]

You index files are (by default) under your spunk install. The path should look something like this:

$SPLUNK_HOME/var/lib/splunk/<index_name>

Hmm. There are a few more things I could say bout this, but borrowing from Simeon's answer... I'm also going to suggest that you contact splunk support. You can submit a high-priority case online, and then call Splunk's support line and talk to someone about your case.

[hexx]

In a case like that (no need to keep the indexed information), you can also just go ahead and wipe your indexes with :

$SPLUNK_HOME/bin/splunk clean all

[Lowell]

Generally it's better to move them; but if you'r just demoing the software then it probably doesn't matter.

[nate1]

Thanks for the response. I found those various folders but wasn't sure if I could actually "delete" the folders completely and it would restart. I just ended up uninstalling and re-installing. As far as support goes, this is just a trial for me, so I don't think I have support.