Splunk Search

"StatsFileWriterLz4 file open failed" error after upgrade to 8.2.3 when searching

podegard
Engager

After upgrading our environment from 8.1.3 to 8.2.3, some searches return "StatsFileWriterLz4 file open failed". Our environment is one Search Head, one Indexer, one Cluster Master connected in an indexer cluster, with one Heavy forwarder and a few Universal Forwarders. All servers are running on Windows 2019. 

A specific error message looks like this: "StatsFileWriterLz4 file open failed file=E:\Splunk\var\run\splunk\srtemp\374915603_1292_at_1637749050.1\statstmp_merged_5.sb.lz4" after running this tstats search:

| tstats max(_time) as time max(_indextime) as indextime where index IN ("operations_script_log","telemetry*") sourcetype=* earliest=-30d@d latest=@d by sourcetype host source date_year date_month date_mday date_hour date_minute

This search completed and returned the desired results prior to the upgrade, but won't complete after. It runs for about nine seconds before the "StatsFileWriterLz4 file open failed" error message appears and stops the search.

Has anybody encountered this problem before and know a solution?

Labels (1)
Tags (2)
1 Solution

podegard
Engager

For anyone seeing this: The solution was to upgrade our environment to 8.2.4. The "StatsFileWriterLz4 file open failed" message does not show up after the upgrade.

View solution in original post

0 Karma

podegard
Engager

For anyone seeing this: The solution was to upgrade our environment to 8.2.4. The "StatsFileWriterLz4 file open failed" message does not show up after the upgrade.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...