I'm getting this error in splunkd.log on Windows 7
What does this mean and how can it be corrected?
08-15-2010 05:18:01.854 FATAL MetaData - failed to rename D:\SPLUNK\var\lib\splunk\defaultdb\db\Sources.data.temp to D:\SPLUNK\var\lib\splunk\defaultdb\db\Sources.data: Access is denied.
There is no Sources.data.temp file in the directory
I suspect a permissions issue.
When you login as the user that splunkd runs as and you attempt to create a new file in D:\SPLUNK\var\lib\splunk\defaultdb\ , do you get an error or are you prompted for the need to be admin to make the change?
Experiencing the same issue on win2003 x64. However there is such file and permissions are ok. Any ideas? Search over the problematic index is very slow.