Splunk Enterprise

Help with Failed to remove alive token Error

kgellis
Engager
 

 

i have noticed this error coming up often and have searched everywhere to find out what it is and if there is a fix for it.

09-29-2021 05:41:07.533 -0500 ERROR ScopedAliveProcessToken [2371353 BundleLookupIndexingExecutorWorker-0] - Failed to remove alive token file='/opt/splunk/var/run/searchpeers/DFADFAB9-11E6-4297-97DF-9227BFECA4AE-1632912055/apps/live_edge/lookups/LiveEdge_FatalLogs.csv_1632911454.870215.cs.index.lock'. No such file or directory

source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd

 

Labels (1)

kgellis
Engager

Still Searching for a solution and or root cause.  so far we just have to flag as known error and check in time to time to see if anyone else may have come up with a different idea.  but the files are gone as the error states as if the process completed but it still tracking the file and attempts to remove it again? 

0 Karma

Zzo911
Engager

Did you find a fix for that?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Can check in the box if the file actually exists and check the permissions?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

dm1
Contributor

facing same issue. were you able to fix this ?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...