Splunk Dev

Splunk Index has Stopped Updating

johnpatrick27
New Member

Hi,

My index has stopped updating for more than a month now. All other indexes I've created in the past are perfectly working but this one. I went to _internal index to see if there are any errors and seeing multiple errors related to TailReader, ExecProcessor, FrameworkUtils. Could anyone confirm if these errors are the culprit for my index to not update, and if so, how could I fix them? I am using Splunk Web. TIA.

5/13/18
6:08:19.685 AM

05-13-2018 06:08:19.685 -0400 WARN TailReader - Access error while handling path: failed to open for checksum: '/export/splunk/var/log/splunk/dbx2.log.rotate.63202366' (No such file or directory)
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM

05-11-2018 15:20:51.091 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.091 PM

05-11-2018 15:20:51.091 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM

05-11-2018 15:20:51.061 -0400 ERROR ExecProcessor - Ignoring: "'/.\bin\scripted_inputs\dbx_conf_fix.py'"
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/11/18
3:20:51.061 PM

05-11-2018 15:20:51.061 -0400 ERROR FrameworkUtils - Incorrect path to script: /.\bin\scripted_inputs\dbx_conf_fix.py. Script must be located inside $SPLUNK_HOME/bin/scripts.
host = nhmanlnx03.cable.comcast.com source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Is that index being filled using DB Connect?

0 Karma

johnpatrick27
New Member

Yes, it is being filled using DB Connect.

0 Karma

xpac
SplunkTrust
SplunkTrust

Do you have any other indexes that are being filled by DBConnect?
The error messages you posted do not look like any kind of index problem, but they point to errors in your DB Connect input. I guess this is a Windows installation?

0 Karma

johnpatrick27
New Member

Yes, there are actually a number of indexes I created and all of them are working except this one. It was working ever since I created it until last month. I didn't have any configuration changes so it is really baffling me. I am not sure if Windows installation is applicable to me, I am only accessing Splunk in web.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...