Splunk Search

ERROR SearchResultsCSVSerializer - Failed to open file for writing

Rob2520
Communicator

Seeing tons of these errors in splunkd logs of indexers. What could be the reason? We are also experiencing search performance issues. Not sure if it's aligned to the error message.

Tags (1)
0 Karma

jbrocks
Communicator

As I can only tell from your information, there must be some missing permissions. E.g. if Splunk tries to write in a file or directory, but does not have the permission to edit this file. Some more information would be helpful. Which user ist the owner of Splunkd process? Which user installed Splunk? What is the full Error message? I think there must be a whole Error message in the log, saying what file or path Splunk tried to edit.

0 Karma

Rob2520
Communicator

Hi @jbrocks User which installed Splunk and owner of splunkd process are the same. I copied the whole error message. Unfortunately the error doesn't say which file it's trying to write to and failing. Is there any way we can find which file it is?

0 Karma

jbrocks
Communicator

Wehre die you her tue error Message? Splunk process loggs to SPLUNK_HOME/var/log/splunk/splunkd.log this is the most common splunk log to look for errors. But also the other logs in that directory might be intresting.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...