Just installed Windows 5.0.2 forwarders and the data is getting successfully indexed and searched from Linux 5.0.2 indexers.
However I see the forwarder's splunkd.log has tons of the following error message repeated frequently.
There are no other errors that precede or follow it. Is this harmless or what?
ERROR SQLitePersistentStorageImpl - [] Error inserting _pInsertStatement in SQLitePersistentStorageImpl::write: SQL logic error or missing database
This is a benign error and known issue, SPL-61702 and tentatively targeted to be fixed in an upcoming maintenance release beyond 4.3.5+ and 5.0.2+
In the meanwhile to disable error logging of this module, add the following stanza entry to a new or existing %SPLUNK_HOME%\etc\log-local.cfg
[splunkd]
category.SQLitePersistentStorageImpl = FATAL
Restart of Splunk will be necessary.
Note: if the forwarder is Splunk Web accessible, you can make the change via
System settings > System Logging search for SQLitePersistentStorageImpl and change from default WARN to FATAL
This will make the change without a forwarder restart but will not be persistent the next time splunkd is restarted.
This should be fixed now with the release of Splunk 6.4.2:
http://docs.splunk.com/Documentation/Splunk/6.4.2/ReleaseNotes/6.4.2
This is a benign error and known issue, SPL-61702 and tentatively targeted to be fixed in an upcoming maintenance release beyond 4.3.5+ and 5.0.2+
In the meanwhile to disable error logging of this module, add the following stanza entry to a new or existing %SPLUNK_HOME%\etc\log-local.cfg
[splunkd]
category.SQLitePersistentStorageImpl = FATAL
Restart of Splunk will be necessary.
Note: if the forwarder is Splunk Web accessible, you can make the change via
System settings > System Logging search for SQLitePersistentStorageImpl and change from default WARN to FATAL
This will make the change without a forwarder restart but will not be persistent the next time splunkd is restarted.