Splunk Enterprise

Forwarder splunkd.log filled with ERROR SQLitePersistentStorageImpl - Error inserting....SQL logic error or missing database

Ellen
Splunk Employee
Splunk Employee

Just installed Windows 5.0.2 forwarders and the data is getting successfully indexed and searched from Linux 5.0.2 indexers.
However I see the forwarder's splunkd.log has tons of the following error message repeated frequently.

There are no other errors that precede or follow it. Is this harmless or what?

ERROR SQLitePersistentStorageImpl - [] Error inserting  _pInsertStatement in SQLitePersistentStorageImpl::write: SQL logic error or missing database
Tags (1)
1 Solution

Ellen
Splunk Employee
Splunk Employee

This is a benign error and known issue, SPL-61702 and tentatively targeted to be fixed in an upcoming maintenance release beyond 4.3.5+ and 5.0.2+

In the meanwhile to disable error logging of this module, add the following stanza entry to a new or existing %SPLUNK_HOME%\etc\log-local.cfg

[splunkd]
category.SQLitePersistentStorageImpl = FATAL

Restart of Splunk will be necessary.

Note: if the forwarder is Splunk Web accessible, you can make the change via
System settings > System Logging search for SQLitePersistentStorageImpl and change from default WARN to FATAL
This will make the change without a forwarder restart but will not be persistent the next time splunkd is restarted.

View solution in original post

Azeemering
Builder

This should be fixed now with the release of Splunk 6.4.2:

http://docs.splunk.com/Documentation/Splunk/6.4.2/ReleaseNotes/6.4.2

0 Karma

Ellen
Splunk Employee
Splunk Employee

This is a benign error and known issue, SPL-61702 and tentatively targeted to be fixed in an upcoming maintenance release beyond 4.3.5+ and 5.0.2+

In the meanwhile to disable error logging of this module, add the following stanza entry to a new or existing %SPLUNK_HOME%\etc\log-local.cfg

[splunkd]
category.SQLitePersistentStorageImpl = FATAL

Restart of Splunk will be necessary.

Note: if the forwarder is Splunk Web accessible, you can make the change via
System settings > System Logging search for SQLitePersistentStorageImpl and change from default WARN to FATAL
This will make the change without a forwarder restart but will not be persistent the next time splunkd is restarted.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...