Hi anyone and everyone, Please could somebody help. I have been using Splunk for the past 2 and a half years. I am using Splunk 5 and whenever I install a Splunk update over the existing Splunk 5, Splunk starts up as normal but after I perform a search, all the data will show until it gets to a point where it all vanishes and is replaced by the following. Error in 'databasePartitionPolicy': Failed to read 1 event(s) from rawdata in bucket 'main~178~02C5891B-D87B-444E-9AEC-E9C8E3E45913'. Rawdata may be corrupt, see search.log At this point I just reinstall the previous version as I need the search data. As I know I am going to have to update it for good at some point can any one fix this corruption issue? Kind regards, Paul ... View more

Can you point me in the right direction. My existing database must be retained on migration to another machine. I am running 4.2.2 on Max OSX Lion Cheers, Paul ... View more