Error in 'databasePartitionPolicy': Failed to read 1 event(s) from rawdata from bucket 'main-112-C7BC880D-F64C-B288-6A8FF984920D',Rawdata ma be corrupt,see search.log

[mariselvan]

Hii All , I need your help to resolve this issue , I am encountering the above mentioned error and subsequently i was not able to pull and eventlog (data) , how can i resolve this issue ? what is the search.log ? where is this stored on the PC ?

Thanks a lot for your help and advice , Much appreciated 🙂

[Voltaire]

What version of Splunk are you using? BTW- Is it a VMware or virtual system? I am experiencing something similar with a VMware Splunk server.
splunk stop splunkd
/opt/splunk/bin/./splunk fsck --all --repair
splunk start splunkd
The other option would be to Clean the indexes and start over with a new index.
http://answers.splunk.com/answers/134553/how-to-delete-data-index-reset-start-from-scratch.html

Hope that helps!