I'm working with a distributed Splunk 6.3.1 architecture with:
And since one day I'm receiving this error message (which is replicating each second on splunk.log):
06-15-2018 11:06:22.950 +0200 ERROR KVStorageProvider - An error occurred during the last operation ('createIndex', domain: '5', code: '10088'): exception: cannot index parallel arrays [area] [group]
Since that day, none of my custom Splunk apps work because the mongo service is down, and I'm receiving this message when I execute an | inputlookup:
Error in 'inputlookup' command: External command based lookup 'kvstore_mykvstore' is not available because KV Store initialization has failed. Please contact your system administrator.
Does anybody knows what is happening here or where can I found more information about this problem? In splunk.log I'm only seeing the KVStorageProvider error, and I don't know where or how I can solve this.
We had a similar and ended up separating the combined accelerated_fields into two separate entries.
Our researched showed that these fields has a few multi-valued entries which we believe mongo saves as arrays thus causing the issue,Check if either of the fields in the KV are multi-valued. We believe that a MV field cannot be part of a multi-part accelerated field (mongo index)