If one of the Indexers ran out-of-space, It may result in incomplete writes to .bucketSummaryManifest in the ../your_index/summary Or ../your_index/datamodel_summary paths. The crash could happen while Splunk reads the corrupt file.
As a workaround:
Run below command to identify possible corrupted files/lines (run from the splunk/var/lib/splunk):
grep -vPn '\"[^\"]+\",\"[^\"]+\",\"[^\"]+\",\d+,\d+,\d+' */summary/.bucketSummaryManifest
grep -vPn '\"[^\"]+\",\"[^\"]+\",\"[^\"]+\",\d+,\d+,\d+' */datamodel_summary/.bucketSummaryManifest
Move the .bucketSummaryManifest file to temp folder outside Splunk then restart the indexer
Confirm that a new .bucketSummaryManifest file is created and keep eyes on your indexer in a problem to see for any additional crash.
Also, we have been fixed that issue 7.0.0 onwards via SPL-141877
Hope it helps.
... View more