Splunk 6.0 stops Indexing. Splunkd.log reports BTreeCP truncation errors

Splunk Employee
Splunk Employee

Customer reports that Splunk 6.0.0 suddenly stops indexing.

splunkd.log reports errors like

ERROR BTreeCP - error moving  save dir 'D:\Splunk\var\lib\splunk\fishbucket\splunk_private_db\save' to old 'D:\Splunk\var\lib\splunk\fishbucket\splunk_private_db\save.old' while truncating

ERROR BTreeCP - addUpdate: IOException caught: BTree::Exception: error moving  save dir 'D:\Splunk\var\lib\splunk\fishbucket\splunk_private_db\save' to old 'D:\Splunk\var\lib\splunk\fishbucket\splunk_private_db\save.old' while truncating.

Splunk SOS app shows Indexing, Typing , Aggregation & Parsing Queues are blocked.

Splunk Employee
Splunk Employee

Splunk are currently investing an issue when _fishbucket reaches maxDataSize. (SPL-82042)

A workaround is to:

1.   splunk stop 
2.  Check the size of maxDataSize in stanza [_thefishbucket]
3.  Create $SPLUNK_HOME/etc/system/local/indexes.conf  with an increased maxDataSize value eg  
 maxDataSize = 1500 
4. Restart Splunk 

A permanent fix will be included in a future maintenance release of Splunk.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...