An hourly scheduled summary search finishes successfully:
12-05-2012 05:17:27.966 +0000 INFO SavedSplunker - savedsearch_id="nobody;XXX;Summary Gen", user="nobody", app="XXX", savedsearch_name="Summary Gen", status=success, digest_mode=1, scheduled_time=1354684620, dispatch_time=1354684644, run_time=3.788, result_count=18244, alert_actions="summary_index", sid="scheduler_nobody_ZW1haWxfbWV0cmljc19hcHA_RMD59f64bf9adfa139f1_at_1354684620_60d34ceed7aa64ec", suppressed=0, thread_id="AlertNotifierWorker-0"
search.log in the dispatch directory has this error
12-05-2012 05:17:27.748 ERROR SummaryIndexProcessor - Error moving file '/var/groupon/splunk/var/run/splunk/1354684647.1.tmp' to '/var/groupon/splunk/var/spool/splunk/RMD59f64bf9adfa139f1_1502598233.stash_new'.
As a result the data doesn't arrive in the summary index. Also interesting that the scheduled search is considered successful
What does this error mean? There is plenty of free disk space.
... View more