Splunk Search

What does 'ERROR IndexProcessor - caught exception for index=os during initialzation: 'Splunk has detected that a directory has been manually copied into its database, causing id conflicts" mean?

mctester
Communicator

I had to migrate a some indexes over from one instance to another. All worked but the 'os' index, and I'm seeing this error in splunkd.log:

ERROR IndexProcessor - caught exception for index=os during initialzation: 'Splunk has detected that a directory has been manually copied into its database, causing id conflicts [/splunk/var/lib/splunk/os/db/db_1302106859_1302041818_0, /splunk/var/lib/splunk/os/db/db_1289448788_1286384533_0].'.Disabling the index, please fix-up and run splunk enable index

Can you tell me how to fix this index and get it back online? Or is it more complicated than that?

Tags (3)

gkanapathy
Splunk Employee
Splunk Employee

Rename the directory, replacing the number _0 at the end with a number that does not conflict with the number of any existing db_* folder or any hot_* folder. Do not modify other parts of the folder name.

dragoslungu
Explorer

Thank you gkanapathy ! 4 years later and it still saves lives 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...