Hi,
My index has stopped updating for more than a month now. All other indexes I've created in the past are perfectly working but this one. I went to _internal index to see if there are any errors and seeing multiple errors related to TailReader, ExecProcessor, FrameworkUtils. Could anyone confirm if these errors are the culprit for my index to not update, and if so, how could I fix them? I am using Splunk Web. TIA.
5/13/18
6:08:19.685 AM
05-13-2018 06:08:19.685 -0400 WARN TailReader - Access error while handling path: failed to open for checksum: '/export/splunk/var/log/splunk/dbx2.log.rotate.63202366' (No such file or directory)
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM
05-11-2018 15:20:51.091 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM
05-11-2018 15:20:51.091 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM
05-11-2018 15:20:51.061 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM
05-11-2018 15:20:51.061 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
Is that index being filled using DB Connect?
Yes, it is being filled using DB Connect.
Do you have any other indexes that are being filled by DBConnect?
The error messages you posted do not look like any kind of index problem, but they point to errors in your DB Connect input. I guess this is a Windows installation?
Yes, there are actually a number of indexes I created and all of them are working except this one. It was working ever since I created it until last month. I didn't have any configuration changes so it is really baffling me. I am not sure if Windows installation is applicable to me, I am only accessing Splunk in web.