- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
While running the search index=networking | timechart count on Splunk v. 6.3.3, we are getting the following error:
Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0
• What does this message mean?
• What steps should I take to troubleshoot this and what logs would give me more insight into the error (besides splunkd.log)?
• What is the possible solution?
Thank you!
Marina
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just an update: we opened splunk support ticket. The plan that worked was to run command $SPLUNK_HOME/bin/splunk fsck scan --all-buckets-all-indexes --v, redirect output to a file, find "corrupted" buckets in output text file, and run the splunk rebuild command on each of the buckets. When rebuild is not working, replace it with a good one from other indexer servers (searchable). This fixed the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just an update: we opened splunk support ticket. The plan that worked was to run command $SPLUNK_HOME/bin/splunk fsck scan --all-buckets-all-indexes --v, redirect output to a file, find "corrupted" buckets in output text file, and run the splunk rebuild command on each of the buckets. When rebuild is not working, replace it with a good one from other indexer servers (searchable). This fixed the issue.
