I'm working with a distributed Splunk 6.3.1 architecture with:
And since one day I'm receiving this error message (which is replicating each second on splunk.log):
06-15-2018 11:06:22.950 +0200 ERROR KVStorageProvider - An error occurred during the last operation ('createIndex', domain: '5', code: '10088'): exception: cannot index parallel arrays [area] [group]
Since that day, none of my custom Splunk apps work because the mongo service is down, and I'm receiving this message when I execute an | inputlookup:
Error in 'inputlookup' command: External command based lookup 'kvstore_mykvstore' is not available because KV Store initialization has failed. Please contact your system administrator.
Does anybody knows what is happening here or where can I found more information about this problem? In splunk.log I'm only seeing the KVStorageProvider error, and I don't know where or how I can solve this.
Thank you very much!
We had a similar and ended up separating the combined accelerated_fields into two separate entries.
Our researched showed that these fields has a few multi-valued entries which we believe mongo saves as arrays thus causing the issue,Check if either of the fields in the KV are multi-valued. We believe that a MV field cannot be part of a multi-part accelerated field (mongo index)
Hi, You mentioned that you are probably using mongodb app.
It looks like an issue with Mongodb per se and not Splunk perhaps.
Check out this below stack link - is this issue similar?