Splunk Enterprise

Help with Failed to remove alive token Error

kgellis
Engager
 

 

i have noticed this error coming up often and have searched everywhere to find out what it is and if there is a fix for it.

09-29-2021 05:41:07.533 -0500 ERROR ScopedAliveProcessToken [2371353 BundleLookupIndexingExecutorWorker-0] - Failed to remove alive token file='/opt/splunk/var/run/searchpeers/DFADFAB9-11E6-4297-97DF-9227BFECA4AE-1632912055/apps/live_edge/lookups/LiveEdge_FatalLogs.csv_1632911454.870215.cs.index.lock'. No such file or directory

source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd

 

Labels (1)

kgellis
Engager

Still Searching for a solution and or root cause.  so far we just have to flag as known error and check in time to time to see if anyone else may have come up with a different idea.  but the files are gone as the error states as if the process completed but it still tracking the file and attempts to remove it again? 

0 Karma

Zzo911
Engager

Did you find a fix for that?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Can check in the box if the file actually exists and check the permissions?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

dm1
Contributor

facing same issue. were you able to fix this ?

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...