Splunk Search

"Cannot seek to rawdata offset 0" running a search in Splunk Web after upgrading Splunk Enterprise from 6.4.2 to 6.5.1

leo_zhao
New Member

When I upgrade Splunk from 6.4.2 to 6.5.1 and search in Splunk Web, then get error:

JournalSliceDirectory: Cannot seek to rawdata offset 0, path="/opt/splunk/var/lib/splunk/defaultdb/db/db_1480493313_1480491958_8/rawdata", why?
0 Karma

dantimola
Communicator
0 Karma

abycemt
New Member

I have this exact issue after upgrading to 6.5.1 as well. It only happens on searches over 30 days. My install is on a single instance centos server.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.