Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Splunk Crashing
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My splunk seems to be crashing. It may or may not have to do with using IE 8 in Splunk 6 to edit an event and create a regex as this appears when it started. The crash log is showing what I have below. Stoping and starting does not seem to be helping. Do I have the db_1383938418_1383938238_26/rawdata file locked somehow?
Cannot open manifest file inside "/apps/wcm-splunk/var/lib/splunk/audit/db/db_1383938418_1383938238_26/rawdata": No such file or directory
splunkd: /opt/splunk/p4/splunk/branches/6.0.0/src/pipeline/input/CsvLineBreaker.cpp:153: virtual bool CsvLineBreaker::parser::gotEol(): Assertion tellLineStart() >= _offsetAtPdStart' failed.tellLineStart() >= _offsetAtPdStart' failed.
2013-11-08 14:30:31.157 -0500 splunkd started (build 182037)
Cannot open manifest file inside "/apps/wcm-splunk/var/lib/splunk/audit/db/db_1383938743_1383938743_27/rawdata": No such file or directory
splunkd: /opt/splunk/p4/splunk/branches/6.0.0/src/pipeline/input/CsvLineBreaker.cpp:153: virtual bool CsvLineBreaker::parser::gotEol(): Assertion
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is... I had somehow deleted the leading [ from the first stanza in my inputs.conf file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is... I had somehow deleted the leading [ from the first stanza in my inputs.conf file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That will do it! Make sure you mark this as answered. It will give you come karma points and you should get a badge.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is once case where I would open a ticket with Splunk. /opt/splunk/bin>splunk diag
upload that diag after creating a ticket here:Splunk Support Portal
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
