Splunk Enterprise

Cannot find bid

jfaldmomacu
Path Finder

I'm getting thousands of log events that says --
ERROR CMSlave [2549383 CMNotifyThread] - Cannot find bid=wineventlog~157~96ECF7C4-1951-4288-B90A-9133E5408F14. cleaning up usage data

It is on all my indexers and references multiple but not all indexes. 

Any ideas on how to fix that error?

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
What is your repFactor on indexes.conf file for those indexes?
And have you on multisite or single site cluster? And what are your RF + SF and site factors if you have multisite cluster?

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

You should try to find another events which contains this bid from your _internal log. Those probably give you some hints what cause this error message.

0 Karma

jfaldmomacu
Path Finder

I picked a bid and searched for it. The only events are about its creation. Then the errors immediately start

2025-04-02 14_48_20-bidNotFound.png 
I checked three other bids with the same results. I even see messages about moving from hot to warm. ("Cleaning up usage" events excluded in these search results.)

2025-04-02 14_55_54-bidNotFound2.png

0 Karma

isoutamo
SplunkTrust
SplunkTrust
What is your repFactor on indexes.conf file for those indexes?
And have you on multisite or single site cluster? And what are your RF + SF and site factors if you have multisite cluster?

jfaldmomacu
Path Finder

I've seen the repFactor set to auto or 0. I'm changing all the non-internal indexes to auto, (adding the line repFactor to the stanzas that are missing them. 
RF and SF are 2.
I have a Single site cluster with 6 indexers. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
In cluster you should also change internals to auto! Otherwise splunk don't replicate those buckets!

jfaldmomacu
Path Finder

But the ones that were missing the specified repFactor were the ones that had thousands of events. The other indexes that already had repFactor set to auto only had a few events with that error. So I think you may be on to something, 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...