Splunk Search

Failed to reap - because of directory not empty

thbrix
New Member

We have a lot of theese errors in splunked.log, I have searched a lot to find an solution but to no success.

ERROR DispatchReaper - Failed to reap /data/splunk/var/run/splunk/dispatch/scheduler_admin_c3BsdW5rX2FwcF93aW5kb3dzX2luZnJhc3RydWN0dXJl_RMD5ce1429bf7fcd63ea_at_1529591400_160 because of Directory not empty

Im not sure what details is needed for helping me. Its a singleserver setup and Splunk is running on RHEL. Splunk is running as the user splunk (not root), and i have checked permissions on the folders mentioned in the log.

I would appreciate any pointers you can help with, thanks!

Tags (1)
0 Karma

CarsonZa
Contributor

you might run chown -Rf splunk. /opt/splunk just to be sure.

else you could try to clean the dispatch directory.

./splunk cmd splunkd clean-dispatch help

should get you started

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...