Splunk Search

Could not read event. Results may be incomplete

arpit_arora
Explorer

Hello, I am seeing the following error while running Splunk search.

"idx=##INDEX NAME HERE## Could not read event: cd=0:33610. Results may be incomplete ! (logging only the first such error; enable DEBUG to see the rest)"

Any idea why it might be happening? How can I search more logging for this error.

Tags (1)

jmantor
Path Finder

I'm seeing a similar error. How would one ID the bucket that is a problem? What component should I put into Debug ?

0 Karma

claudio_manig
Communicator

Here's what i used-- kudos to splunk support for that one:
Ensure that you've got $SPLUNK_DB set in your environment (source $SPLUNK_HOME/bin/setSplunkEnv):

find $SPLUNK_DB -type f -wholename '/db/[dr]b_/rawdata/journal.gz' | perl -ne 'chomp;$d=$;$d=~s/journal.gz$//;if(-e "$d/slicesv2.dat"){@s=splunk cmd splunkd slices-dat-util --print \Q$d\E;if(${^CHILD_ERROR_NATIVE}){print STDERR "Error processing $d\n"}elsif($s[$#s]!~/\d+:(?:\s+\d+){2}\s+(\d+)/){print STDERR "Error parsing results from $d\n"}else{print "$d\n" if $1 >= ((stat "$")[7])}}'

cheers

0 Karma

C_HIEN
Path Finder

Try to stop the indexer and do a rebuild on the bucket. Therefore sometimes even if the rebuild seems successful the bucket is still corrupted (7.0.1)

0 Karma

jaho_splunk
Engager

I am also seeing this for the _internal index: [indexer] idx=_internal Could not read event: cd=(n/a). Results may be incomplete !

0 Karma

C_HIEN
Path Finder

The "Could not read event: cd=(n/a)" bug has been fixed in 7.0.1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...