Why is my search resulting in error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0"?

[mlevsh]

While running the search index=networking | timechart count on Splunk v. 6.3.3, we are getting the following error:

Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0

• What does this message mean?
• What steps should I take to troubleshoot this and what logs would give me more insight into the error (besides splunkd.log)?
• What is the possible solution?

Thank you!
Marina

[mlevsh · Accepted solution]

Just an update: we opened splunk support ticket. The plan that worked was to run command $SPLUNK_HOME/bin/splunk fsck scan --all-buckets-all-indexes --v, redirect output to a file, find "corrupted" buckets in output text file, and run the splunk rebuild command on each of the buckets. When rebuild is not working, replace it with a good one from other indexer servers (searchable). This fixed the issue.