Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to fix this datamodel error ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"Error decompressing zstd block: Corrupted block detected"
This error appears when I search with datamodel but this datamodel isn't accelerated and with searches with a lot of results, and I want to know how to fix it and what is the reason for that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We solved this problem improving the server performance with more processors and RAM.
On search.log of your search, on $HOME_SPLUNK/var/run/splunk/dispatcher/ should show something like the following to know that the ZSTD is working fine:
DEBUG BlockDecompressingStream - ZSTD block header=070434
DEBUG BlockDecompressingStream - ZSTD decided we needed input_size=57478, previous_size=65536
BlockDecompressingStream - output_offset=1179648, block_size=1048576
DEBUG BlockDecompressingStream - ZSTD decompressed block, buffered=1, isize=57478, osize=131072
DEBUG SortOperator - deserializing chunk from /opt/splunk/var/run/splunk/dispatch/1568790023.15/statstmp_partition0_1568794563.543.srs.zst
DEBUG SRSSerializer - deserializeChunk - curChunk=20 nCols=57 num=20000 nChunks=50
DEBUG SRSSerializer - readChunk: chunkMeta: nRows=1000 nBytes=208580 opts.start=0 opts.num=0 opts.append=0 globalMeta.nChunks=50 nCols=57
You need to enable DEBUG at Server settings > Server loggins for searches...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We solved this problem improving the server performance with more processors and RAM.
On search.log of your search, on $HOME_SPLUNK/var/run/splunk/dispatcher/ should show something like the following to know that the ZSTD is working fine:
DEBUG BlockDecompressingStream - ZSTD block header=070434
DEBUG BlockDecompressingStream - ZSTD decided we needed input_size=57478, previous_size=65536
BlockDecompressingStream - output_offset=1179648, block_size=1048576
DEBUG BlockDecompressingStream - ZSTD decompressed block, buffered=1, isize=57478, osize=131072
DEBUG SortOperator - deserializing chunk from /opt/splunk/var/run/splunk/dispatch/1568790023.15/statstmp_partition0_1568794563.543.srs.zst
DEBUG SRSSerializer - deserializeChunk - curChunk=20 nCols=57 num=20000 nChunks=50
DEBUG SRSSerializer - readChunk: chunkMeta: nRows=1000 nBytes=208580 opts.start=0 opts.num=0 opts.append=0 globalMeta.nChunks=50 nCols=57
You need to enable DEBUG at Server settings > Server loggins for searches...
Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco
Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data
Your summer travels continue with new course releases
