Does anyone have any idea why this is happening?
11-19-2013 15:17:34.908 -0500 ERROR SQLitePersistentStorageImpl - Error executing: select primarykey, value from keyvaluepairs_t where secondary1 = ?1 Msg=unable to open database file
11-19-2013 15:17:34.908 -0500 ERROR FSChangeMonitor - Exception thrown in update(2) - continuing
I have hundreds of these in my splunkd.log file.
You can try this if you are still having issues:
Browse to /opt/splunk/var/lib/splunk/persistentstorage/fschangemanager_state/ and in that directory, there is also a file called "fschangemanager_state". Rename that file or move it to a temporary location and then restart Splunk.
I made changes to the permissions on the splunk folder for the splunk service (windows) and this error has resolved itself. Interesting since I just noticed it, and I've had a Splunk install for 2 years. I wonder if the upgrade to 6 changed something.
To what did you change the permissions
what were they set to when it was failing
I have the same problem, but having difficulty find the folder causing the problem
Also having the same issue, could you provide any steps for troubleshooting? As well as the fix?