FSChangeMonitor errors?

[jgauthier]

Does anyone have any idea why this is happening?

11-19-2013 15:17:34.908 -0500 ERROR SQLitePersistentStorageImpl - Error executing: select primarykey, value from keyvaluepairs_t where secondary1 = ?1 Msg=unable to open database file
11-19-2013 15:17:34.908 -0500 ERROR FSChangeMonitor - Exception thrown in update(2) - continuing

I have hundreds of these in my splunkd.log file.

[rmorlen_splunk]

You can try this if you are still having issues:

Browse to /opt/splunk/var/lib/splunk/persistentstorage/fschangemanager_state/ and in that directory, there is also a file called "fschangemanager_state". Rename that file or move it to a temporary location and then restart Splunk.

[jgauthier]

I made changes to the permissions on the splunk folder for the splunk service (windows) and this error has resolved itself. Interesting since I just noticed it, and I've had a Splunk install for 2 years. I wonder if the upgrade to 6 changed something.

[kfleming]

To what did you change the permissions
what were they set to when it was failing

I have the same problem, but having difficulty find the folder causing the problem

[andriy_noble]

Also having the same issue, could you provide any steps for troubleshooting? As well as the fix?