Splunk Search

Fatal MetaData message re: sources.data in splunkd.log

Jaci
Splunk Employee
Splunk Employee

I'm getting this error in splunkd.log on Windows 7

What does this mean and how can it be corrected?

08-15-2010 05:18:01.854 FATAL MetaData - failed to rename D:\SPLUNK\var\lib\splunk\defaultdb\db\Sources.data.temp to D:\SPLUNK\var\lib\splunk\defaultdb\db\Sources.data: Access is denied.

There is no Sources.data.temp file in the directory

Tags (1)

Arseny
New Member

Experiencing the same issue on win2003 x64. However there is such file and permissions are ok. Any ideas? Search over the problematic index is very slow.

0 Karma

hexx
Splunk Employee
Splunk Employee

I suspect a permissions issue.

When you login as the user that splunkd runs as and you attempt to create a new file in D:\SPLUNK\var\lib\splunk\defaultdb\ , do you get an error or are you prompted for the need to be admin to make the change?

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...