Hi, we are seeing > 70,000 of these messages per day per instance on several Searchheads on Splunk 126.96.36.199 and SUSE Linux 12: WARN SearchResultsCSVSerializer - CSV file contains invalid field '', ignoring column. (there are actually two spaces after "file", and '' are two single quotes) In a Searchhead Cluster only the captain seems to report this. If I clone the Splunk installation from an affected Searchhead to another, similar but unaffected one that doesn't show the symptoms, I cannot reproduce the messages there. At startup it kicks in around here: 04-12-2021 16:56:47.361 +0200 INFO ServerRoles - Declared role=search_head. 04-12-2021 16:56:49.680 +0200 INFO ServerRoles - Declared role=kv_store. 04-12-2021 16:56:49.684 +0200 INFO CertStorageProvider - Updating status from starting to ready 04-12-2021 16:56:49.684 +0200 INFO CertStorageProvider - Updating status from starting to ready 04-12-2021 16:56:49.684 +0200 INFO Rsa2FA - Could not find [externalTwoFactorAuthSettings] in authentication stanza. 04-12-2021 16:56:50.911 +0200 WARN SearchResultsCSVSerializer - CSV file contains invalid field '', ignoring column. When the system goes down it stops here: 04-12-2021 16:56:02.889 +0200 WARN SearchResultsCSVSerializer - CSV file contains invalid field '', ignoring column. 04-12-2021 16:56:03.831 +0200 INFO loader - Shutdown HTTPDispatchThread 04-12-2021 16:56:03.831 +0200 INFO ShutdownHandler - Shutting down splunkd a) Has anyone seen this too? And if so, fixed it? How? b) How can I get Splunk to report some more detail, like who wants to open that file? I found no useful information on the SearchResultsCSVSerializer and "strace" on Linux did not provide any clue for me either. Thanks in advance Volkmar
... View more
I understand that those files are part of a locking mechanism in the coldstorage. To de-fluff our directories I want to get rid of the stale ones. Is it safe to delete them after checking that there is no corresponding directory present, i.e. no directory named like the .rbsentinel file minus a leading dot and the appendix? Thanks in advance!
... View more