Splunk Search

How do I resolve this error in index: _internal?

Taruchit
Contributor

Hello All,

I am searching for corrupt data in Splunk, and thus executed the below query: -

 

 

 

index=_internal sourcetype=splunk_search_messages "corrupt" OR "corrupted"

 

 

 

I got the below errors: -

Error 1: -

message=[wd*****] [subsearch]: Failed to read size=4 event(s) from rawdata in bucket='dummyIndex~119~8X88XXY-X8XX-88X8-888X-X88X88XX8888' path='/u01/ovz/data/dummyIndex/db/db_1611661166_1611222333_111_8X88XX8X-X8XX-88X8-888X-X88X88XX8888. Rawdata may be corrupt, see search.log.  Results may be incomplete!

Error 2: -

01-01-2023 07:01:01.098 ERROR SRSSerializer [12729 RemoteTimelineReadThread] - cannot read file magic -probably corrupt

Error 3: - 

Error decompressing zstd block: Corrupted block detected

I need your help to understand and get details about the above errors, Error 1, Error 2 and Error 3.

In Error 1, it states to check search.log. Thus, it would be helpful if you can share how to fetch the relevant information from the file. 

So far for error 1, I found https://community.splunk.com/t5/Splunk-Search/Searchquery-error/m-p/509508 which states that file may be corrupt.

Any information about the above two errors will be very helpful.

Thank you

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Error #1 should not reference the search log since there is nothing in the message that tells us what search is reported the error. You can ignore that suggestion.  You can, however, use the fsck command to attempt to repair the file.

The other two error messages do not provide enough information to diagnose or fix anything.  Unless there are other messages that offer more context or information then you can ignore the error.

 

---
If this reply helps you, Karma would be appreciated.

Taruchit
Contributor

For error 1, I fetched following details on https://docs.splunk.com/Documentation/Splunk/9.0.4/Indexer/HowSplunkstoresindexes: -

db_1611661166_1611222333_111_8X88XX8X-X8XX-88X8-888X-X88X88XX8888

  • db: Originating bucket
  • 1611661166: Newest time
  • 1611222333: Oldest time
  • 111: localid; ID for the bucket
  • 8X88XX8X-X8XX-88X8-888X-X88X88XX8888: guid; guid of the source peer node
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That is the correct breakdown of a bucket name.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...