Splunk Crashing

[andrewkenth]

My splunk seems to be crashing. It may or may not have to do with using IE 8 in Splunk 6 to edit an event and create a regex as this appears when it started. The crash log is showing what I have below. Stoping and starting does not seem to be helping. Do I have the db_1383938418_1383938238_26/rawdata file locked somehow?

Cannot open manifest file inside "/apps/wcm-splunk/var/lib/splunk/audit/db/db_1383938418_1383938238_26/rawdata": No such file or directory
splunkd: /opt/splunk/p4/splunk/branches/6.0.0/src/pipeline/input/CsvLineBreaker.cpp:153: virtual bool CsvLineBreaker::parser::gotEol(): Assertion tellLineStart() >= _offsetAtPdStart' failed.
2013-11-08 14:30:31.157 -0500 splunkd started (build 182037)
Cannot open manifest file inside "/apps/wcm-splunk/var/lib/splunk/audit/db/db_1383938743_1383938743_27/rawdata": No such file or directory
splunkd: /opt/splunk/p4/splunk/branches/6.0.0/src/pipeline/input/CsvLineBreaker.cpp:153: virtual bool CsvLineBreaker::parser::gotEol(): AssertiontellLineStart() >= _offsetAtPdStart' failed.

[andrewkenth · Accepted solution]

The answer is... I had somehow deleted the leading [ from the first stanza in my inputs.conf file.

[ShaneNewman]

That will do it! Make sure you mark this as answered. It will give you come karma points and you should get a badge.

[ShaneNewman]

This is once case where I would open a ticket with Splunk. /opt/splunk/bin>splunk diag

upload that diag after creating a ticket here:Splunk Support Portal