Splunk Enterprise

Help with Failed to remove alive token Error

kgellis
Engager
 

 

i have noticed this error coming up often and have searched everywhere to find out what it is and if there is a fix for it.

09-29-2021 05:41:07.533 -0500 ERROR ScopedAliveProcessToken [2371353 BundleLookupIndexingExecutorWorker-0] - Failed to remove alive token file='/opt/splunk/var/run/searchpeers/DFADFAB9-11E6-4297-97DF-9227BFECA4AE-1632912055/apps/live_edge/lookups/LiveEdge_FatalLogs.csv_1632911454.870215.cs.index.lock'. No such file or directory

source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd

 

Labels (1)

kgellis
Engager

Still Searching for a solution and or root cause.  so far we just have to flag as known error and check in time to time to see if anyone else may have come up with a different idea.  but the files are gone as the error states as if the process completed but it still tracking the file and attempts to remove it again? 

0 Karma

Zzo911
Engager

Did you find a fix for that?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Can check in the box if the file actually exists and check the permissions?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

dm1
Contributor

facing same issue. were you able to fix this ?

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...