Why did my Splunkforwarder stop with the error "WatchedFile - About to assert due to: destroying state while still cached..." in the splunkd.log?

[joe7409]

Splunkforwarder stops with the below error in the splunkd.log:

0500 ERROR WatchedFile - About to assert due to: destroying state while still cached: state=0x0x7f0e5991c780 wtf=0x0x7f0e5992f200 off=0 initcrc=0xeecf05
88f22411cc scrc=0x0 fallbackcrc=0x0 last_eof_time=1424150223 reschedule_target=0 is_cached=343536 fd_valid=true exists=true last_char_newline=true on_block_boundary=true only_no
tified_once=false was_replaced=true eof_seconds=3 unowned=false always_read=false was_too_new=false is_batch=true name="/var/log/mongo/rotated/mongod.log.2015-02-17.1424150222"

[sgarvin55]

This is a Known Issue, SPL-94913 and fixed in Splunk 6.2.2.

[mookiie2005]

I downvoted this post because we are running splunk 6.4.0 and have the same issue.

[JimDeich]

I know this mean the file was in a transient state but I need a work-around for this also. It seem splunk should just drop the file and
go on.