Knowledge Management

ERROR KVStorageProvider - Operation createIndex - Cannot index parallel arrays

Path Finder

Hi,

I'm working with a distributed Splunk 6.3.1 architecture with:

1 SH
1 IDX
1 HF

And since one day I'm receiving this error message (which is replicating each second on splunk.log):

06-15-2018 11:06:22.950 +0200 ERROR KVStorageProvider - An error occurred during the last operation ('createIndex', domain: '5', code: '10088'): exception: cannot index parallel arrays [area] [group]

Since that day, none of my custom Splunk apps work because the mongo service is down, and I'm receiving this message when I execute an | inputlookup:

Error in 'inputlookup' command: External command based lookup 'kvstore_mykvstore' is not available because KV Store initialization has failed. Please contact your system administrator.

Does anybody knows what is happening here or where can I found more information about this problem? In splunk.log I'm only seeing the KVStorageProvider error, and I don't know where or how I can solve this.

Thank you very much!

0 Karma

Path Finder

We had a similar and ended up separating the combined accelerated_fields into two separate entries.

Our researched showed that these fields has a few multi-valued entries which we believe mongo saves as arrays thus causing the issue,Check if either of the fields in the KV are multi-valued. We believe that a MV field cannot be part of a multi-part accelerated field (mongo index)

0 Karma

Champion

Hi, You mentioned that you are probably using mongodb app.
It looks like an issue with Mongodb per se and not Splunk perhaps.
Check out this below stack link - is this issue similar?
https://stackoverflow.com/questions/25059525/indexing-parallel-arrays-in-mongodb

0 Karma