Hello.
We have a clustered environment, several searcheads, several indexers, Splunk 6.4.0
I am running the following search:
index=_internal sourcetype="splunkd" log_level="ERROR"
| stats sparkline count dc(host) as hosts last(_raw) as last_raw_msg values(sourcetype) as sourcetype last(_time) as last_msg_time first(_time) as first_msg_time values(index) as index by punct
| eval delta=round((first_msg_time-last_msg_time),2)
| eval msg_per_sec=round((count/delta),2)
| convert ctime(last_msg_time) ctime(first_msg_time)
| table last_raw_msg count hosts sparkline sourcetype
| sort limit=10 -count
(some error messages reported by splunkd).
One type of message is:
02-11-2019 08:00:04.541 +0000 ERROR SummarySizeManager - Cannot compute size on disk for dir="/opt/splunk/hot/summary/X_XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX": No such file or directory.
The error is received from all the indexers except one.
From my point of view the indexers are configured identically.
Why all the indexers except 1 are throwing this error? Is the file/folder really present somewhere (I didn't find it - neither on indexers, neither on search heads)? Do you have any recommendation about what causes this problem? Could an index disk usage cause this? (for example if the index is using "too much" of its allocated space?)
I am asking the question before opening a case with the support. Although it is an error message, I am unable to find bad things linked to it (it seems benign for now). But I would like to understand why it happens.
Thank you,
Adrian Smeria
