Splunk Search

What does 'ERROR IndexProcessor - caught exception for index=os during initialzation: 'Splunk has detected that a directory has been manually copied into its database, causing id conflicts" mean?

mctester
Communicator

I had to migrate a some indexes over from one instance to another. All worked but the 'os' index, and I'm seeing this error in splunkd.log:

ERROR IndexProcessor - caught exception for index=os during initialzation: 'Splunk has detected that a directory has been manually copied into its database, causing id conflicts [/splunk/var/lib/splunk/os/db/db_1302106859_1302041818_0, /splunk/var/lib/splunk/os/db/db_1289448788_1286384533_0].'.Disabling the index, please fix-up and run splunk enable index

Can you tell me how to fix this index and get it back online? Or is it more complicated than that?

Tags (3)

gkanapathy
Splunk Employee
Splunk Employee

Rename the directory, replacing the number _0 at the end with a number that does not conflict with the number of any existing db_* folder or any hot_* folder. Do not modify other parts of the folder name.

dragoslungu
Explorer

Thank you gkanapathy ! 4 years later and it still saves lives 🙂

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!