Since the answer was written, I've learned more about bucket names. The "rb_" prefix means the bucket was a replicate when it was first created. However, it may now be the primary bucket if the original primary was lost (buckets are not renamed in that case). The "db_" prefix is for primary buckets. Use the fsck command to repair it. The "hot_" prefix is for hot buckets - those open for writing. Restart the indexer to roll the bucket to warm ("db_*") then use fsck. As the error message says, the bucket may be corrupt - or maybe there's something else wrong. If the fsck command doesn't fix it then contact Splunk Support for assistance. They may be able to determine the reason for the failure. Since we don't have access to the bucket file structure, there's no way to look inside to see what the problem is. Splunk Support will have to do that for you. It's unlikely, however, that they can tell you which forwarder sent the data (that's not recorded, by default) or when the corruption happened. Keep in mind that the raw data in a warm or cold bucket is never written to so it never changes. However, buckets are collections of files and any of the supporting files in a bucket could change enough to prevent an indexer from reading data properly. Likewise, a file system error might keep an indexer from reading a bucket.
... View more
