Splunk Dev

Splunk Index has Stopped Updating

johnpatrick27
New Member

Hi,

My index has stopped updating for more than a month now. All other indexes I've created in the past are perfectly working but this one. I went to _internal index to see if there are any errors and seeing multiple errors related to TailReader, ExecProcessor, FrameworkUtils. Could anyone confirm if these errors are the culprit for my index to not update, and if so, how could I fix them? I am using Splunk Web. TIA.

5/13/18
6:08:19.685 AM

05-13-2018 06:08:19.685 -0400 WARN TailReader - Access error while handling path: failed to open for checksum: '/export/splunk/var/log/splunk/dbx2.log.rotate.63202366' (No such file or directory)
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM

05-11-2018 15:20:51.091 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM

05-11-2018 15:20:51.091 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM

05-11-2018 15:20:51.061 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM

05-11-2018 15:20:51.061 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Is that index being filled using DB Connect?

0 Karma

johnpatrick27
New Member

Yes, it is being filled using DB Connect.

0 Karma

xpac
SplunkTrust
SplunkTrust

Do you have any other indexes that are being filled by DBConnect?
The error messages you posted do not look like any kind of index problem, but they point to errors in your DB Connect input. I guess this is a Windows installation?

0 Karma

johnpatrick27
New Member

Yes, there are actually a number of indexes I created and all of them are working except this one. It was working ever since I created it until last month. I didn't have any configuration changes so it is really baffling me. I am not sure if Windows installation is applicable to me, I am only accessing Splunk in web.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...