Knowledge Management

ERROR KVStorageProvider - Operation createIndex - Cannot index parallel arrays

Path Finder


I'm working with a distributed Splunk 6.3.1 architecture with:

1 SH
1 HF

And since one day I'm receiving this error message (which is replicating each second on splunk.log):

06-15-2018 11:06:22.950 +0200 ERROR KVStorageProvider - An error occurred during the last operation ('createIndex', domain: '5', code: '10088'): exception: cannot index parallel arrays [area] [group]

Since that day, none of my custom Splunk apps work because the mongo service is down, and I'm receiving this message when I execute an | inputlookup:

Error in 'inputlookup' command: External command based lookup 'kvstore_mykvstore' is not available because KV Store initialization has failed. Please contact your system administrator.

Does anybody knows what is happening here or where can I found more information about this problem? In splunk.log I'm only seeing the KVStorageProvider error, and I don't know where or how I can solve this.

Thank you very much!

0 Karma

Path Finder

We had a similar and ended up separating the combined accelerated_fields into two separate entries.

Our researched showed that these fields has a few multi-valued entries which we believe mongo saves as arrays thus causing the issue,Check if either of the fields in the KV are multi-valued. We believe that a MV field cannot be part of a multi-part accelerated field (mongo index)

0 Karma


Hi, You mentioned that you are probably using mongodb app.
It looks like an issue with Mongodb per se and not Splunk perhaps.
Check out this below stack link - is this issue similar?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>