Splunk Search

Error message when running a subsearch after upgrading to Splunk 8.0.4.: "StatsFileReader file open failed file".


Hi all,

Upon a recent upgrade to Splunk 8.0.4, I started seeing this error message when running a subsearch against a metric index using the mstats command:

StatsFileReader file open failed file=G:\Program Files\Splunk\var\run\splunk\dispatch\subsearch_1591031620.129695_967FF3A8-E48E-44F1-9399-E958A1F07906_1591031649.2\statstmp_96.sb.lz4

When I checked the folder \Program Files\Splunk\var\run\splunk\dispatch\subsearch_1591031620.129695_967FF3A8-E48E-44F1-9399-E958A1F07906_1591031649.2 on the search head executing the search, the file does not seem to exist.

I have tried researching the issue to no avail.
Has anyone seen this issue yet, and if so, is there a solution to the issue?

Thanks in advance!

Labels (2)
0 Karma

New Member

Hello there,


we updated Splunk to ver. 8.x.x and experienced the same issue with one of our "tstats" commands.
Did you solve the problem?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!