Thanks for your answer! I think I'll go for a cron scheduled bash script to generate the CSV lookup file once a day 🙂 ... View more

I solved it by disable the index that had a damaged journal file from cli: /opt/splunk/bin/splunk disable index name_of_your_index I started splunk up and enabled the index from the web gui and restarted splunk to see if it starts ok without errors. Looks like splunk removed the broken journal file during that process. Another suggestion that I got from Splunk Support was to just move the broken journal file away (while splunkd turned off) to another place and then start splunk. ... View more

I have encountered the same problem today. ... View more