Monitoring Splunk
Highlighted

Splunk Crashing

Communicator

My splunk seems to be crashing. It may or may not have to do with using IE 8 in Splunk 6 to edit an event and create a regex as this appears when it started. The crash log is showing what I have below. Stoping and starting does not seem to be helping. Do I have the db13839384181383938238_26/rawdata file locked somehow?

Cannot open manifest file inside "/apps/wcm-splunk/var/lib/splunk/audit/db/db1383938418138393823826/rawdata": No such file or directory
splunkd: /opt/splunk/p4/splunk/branches/6.0.0/src/pipeline/input/CsvLineBreaker.cpp:153: virtual bool CsvLineBreaker::parser::gotEol(): Assertion `tellLineStart() >= _offsetAtPdStart' failed.
2013-11-08 14:30:31.157 -0500 splunkd started (build 182037)
Cannot open manifest file inside "/apps/wcm-splunk/var/lib/splunk/audit/db/db
1383938743138393874327/rawdata": No such file or directory
splunkd: /opt/splunk/p4/splunk/branches/6.0.0/src/pipeline/input/CsvLineBreaker.cpp:153: virtual bool CsvLineBreaker::parser::gotEol(): Assertion `tellLineStart() >= _offsetAtPdStart' failed.

Tags (1)
Highlighted

Re: Splunk Crashing

Motivator

This is once case where I would open a ticket with Splunk. /opt/splunk/bin>splunk diag

upload that diag after creating a ticket here:Splunk Support Portal

0 Karma
Highlighted

Re: Splunk Crashing

Communicator

The answer is... I had somehow deleted the leading [ from the first stanza in my inputs.conf file.

View solution in original post

Highlighted

Re: Splunk Crashing

Motivator

That will do it! Make sure you mark this as answered. It will give you come karma points and you should get a badge.

0 Karma