Splunk Enterprise

Splunk Indexer Can't move bucket to frozen path- How do I resolve this error?

batabay
Path Finder

Hi,

I can't move buckets to splunk frozen archive, its gives an errors.

07-19-2022 12:36:37.249 +0300 INFO DatabaseDirectoryManager - Getting size on disk: Unable to get size on disk for bucket id=kart~37~D99E1DD0-C0D8-4BE9-9A46-D4EDE5EFE178 path="/data/splunk/var/lib/splunk/kart/db/hot_v1_37" (This is usually harmless as we may be racing with a rename in BucketMover or the S2SFileReceiver threadwhich should be obvious in log filethe previous WARN message about this path can safely be ignored.caller=serialize_SizeOnDisk

I set a file permission, chown splunk: to frozen_path

I increased ulimit to infinite

I can create file and folder on frozen path with splunk user, But as ı said, Splunk can't move buckets to frozen archieve.

Thank you.

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...