How to fix this datamodel error ?

[arahf]

"Error decompressing zstd block: Corrupted block detected"

This error appears when I search with datamodel but this datamodel isn't accelerated and with searches with a lot of results, and I want to know how to fix it and what is the reason for that.

[jam00 · Accepted solution]

We solved this problem improving the server performance with more processors and RAM.

On search.log of your search, on $HOME_SPLUNK/var/run/splunk/dispatcher/ should show something like the following to know that the ZSTD is working fine:

DEBUG BlockDecompressingStream - ZSTD block header=070434
DEBUG BlockDecompressingStream - ZSTD decided we needed input_size=57478, previous_size=65536
BlockDecompressingStream - output_offset=1179648, block_size=1048576
DEBUG BlockDecompressingStream - ZSTD decompressed block, buffered=1, isize=57478, osize=131072
DEBUG SortOperator - deserializing chunk from /opt/splunk/var/run/splunk/dispatch/1568790023.15/statstmp_partition0_1568794563.543.srs.zst
DEBUG SRSSerializer - deserializeChunk - curChunk=20 nCols=57 num=20000 nChunks=50
DEBUG SRSSerializer - readChunk: chunkMeta: nRows=1000 nBytes=208580 opts.start=0 opts.num=0 opts.append=0 globalMeta.nChunks=50 nCols=57

You need to enable DEBUG at Server settings > Server loggins for searches...