Searchquery error

[Reethika]

Hi, While I'm running splunk  for a search for timeperiod = 1year.

I always getting this error

[xxxxindexernamexxxx]  Failed to read size=1 event(s) from rawdata in bucket='os~708~1FBB5DA1-4091-4DEA-9134-E6C689617D66' path='/opt/splunkcolddata/os/colddb/rb_1590815402_1590790190_708_1FBB5DA1-4091-4DEA-9134-E6C689617D66. Rawdata may be corrupt, see search.log. Results may be incomplete!

Does this mean that particular file "rb_1590815402_1590790190_708_1FBB5DA1-4091-4DEA-9134-E6C689617D66" is corrupted?

If so can we retrieve this? 

Thanks.

[richgalloway · Accepted solution]

It means that specific file may be corrupt.  You have two options:

1. Run the Splunk fsck command to scan and/or repair the bucket.  See https://docs.splunk.com/Documentation/Splunk/8.0.4/Troubleshooting/CommandlinetoolsforusewithSupport...
2. Since this is a replicated bucket (based on the "rb_" prefix), stop the indexer, delete the bucket, then restart the indexer.  The cluster master will create a new replicate bucket.

     UPDATE: the "rb_" prefix means the bucket was a replicate when it was first created.  However, it may now be the primary bucket if the original primary was lost (buckets are not renamed in that case).