Splunk Enterprise

Cannot find bid

jfaldmomacu
Path Finder

I'm getting thousands of log events that says --
ERROR CMSlave [2549383 CMNotifyThread] - Cannot find bid=wineventlog~157~96ECF7C4-1951-4288-B90A-9133E5408F14. cleaning up usage data

It is on all my indexers and references multiple but not all indexes. 

Any ideas on how to fix that error?

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
What is your repFactor on indexes.conf file for those indexes?
And have you on multisite or single site cluster? And what are your RF + SF and site factors if you have multisite cluster?

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

You should try to find another events which contains this bid from your _internal log. Those probably give you some hints what cause this error message.

0 Karma

jfaldmomacu
Path Finder

I picked a bid and searched for it. The only events are about its creation. Then the errors immediately start

2025-04-02 14_48_20-bidNotFound.png 
I checked three other bids with the same results. I even see messages about moving from hot to warm. ("Cleaning up usage" events excluded in these search results.)

2025-04-02 14_55_54-bidNotFound2.png

0 Karma

isoutamo
SplunkTrust
SplunkTrust
What is your repFactor on indexes.conf file for those indexes?
And have you on multisite or single site cluster? And what are your RF + SF and site factors if you have multisite cluster?

jfaldmomacu
Path Finder

I've seen the repFactor set to auto or 0. I'm changing all the non-internal indexes to auto, (adding the line repFactor to the stanzas that are missing them. 
RF and SF are 2.
I have a Single site cluster with 6 indexers. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
In cluster you should also change internals to auto! Otherwise splunk don't replicate those buckets!

jfaldmomacu
Path Finder

But the ones that were missing the specified repFactor were the ones that had thousands of events. The other indexes that already had repFactor set to auto only had a few events with that error. So I think you may be on to something, 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...