Hi there,
Has anyone ever seen this error before?
ERROR S2SFileReceiver - event=onFileOpened replicationType=eArtifactFiles bid=scheduler_nobody_U3BsdW5rX1NBX0NJTQRMD59cba5de3e5a67614_at_1541575200_6446_16E88529-EB98-43A0-BFD9-DF736A83CFE5 src=60B1F1D5-3CFA-45F0-9E43-02C72A5FC175 path=/opt/splunk/var/run/splunk/dispatch/schedulernobody_U3BsdW5rX1NBX0NJTQ_RMD59cba5de3e5a67614_at_1541575200_6446_16E88529-EB98-43A0-BFD9-DF736A83CFE5-E38A1713-F4CE-4710-A795-8DAA7ED0F654.tar status=failed err="event=SHPSlave::addArtifact_locked artifact already exists"
I suspect it has something to do with reaping from a scheduled search. The interesting thing is that it is a .tar..so its a tarred version of all the csv files etc that is usually in there?..Maybe TTL setting?
I have matched some of the SIDS to search names and they seem to originate from ES scheduled searches.
Any thoughts?
Thanks!
