Possible Bad Pointer in Index or Database?

[dladkisson]

After a system reboot for updates, SplunkWeb didn't not relaunch successfully after restart. After letting it sit for a few minutes SplunkWeb did finally launch however it appears that perhaps there was a corruption in the event database.

All I am feeding into it right now is Cisco IDS events using the Splunk_CiscoIPS plugin; latest versions of both the plugin and Splunk.

I cannot seem to find in the documentation a way to check the event database for errors nor figure out which database may even be affected.

If I start a query that overlaps the 15/20 minutes where the Splunkweb was down, the search hangs when it gets to that period. Searching outside the 'damaged' period returns results just fine.

Any suggestions would be greatly appreciated.

[dwaddle]

It sounds like you may have a corrupted bucket. No real great answer here, except you probably would be best off to open a support case.

You could try quasi-randomly moving buckets out of your index directories. The dbinspect command might help you figure out which buckets match the time ranges of interest. Obviously, this approach may cause you to have data loss, where support might (if you're lucky) be able to avoid that.