Hello,
I'm experiencing this error when I perform some searches on my index,
idx= Could not read event: cd=(n/a). Results may be incomplete ! (logging only the first such error; enable DEBUG to see the rest)
I saw this issue was fixed on 7.0.1 but my instances are on 6.4.8, is there a workaround for this or a way to fix it?
I tried these commands:
splunk fsck scan --all-buckets-all-indexes
splunk fsck repair --all-buckets-all-indexes
But it with no success.
Thanks in advance
Did you ever get a resolution to this?
I have been getting the same errors when querying some indexes over long periods of time.
I believe we have corrupt buckets, potentially as a result of a stray fsck.
During routine inspeciton of the Indexers I recall seeing a couple of fsck processes not as a child process of splunkd - which seemed very odd.
Running 7.00 - due to upgade to 7.01+ shortly.,
Hey dd_msearles,
The issue solved itself since the events causing the issue were removed due to my retention time period.
Sorry for not being of great help.
Regards