- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITSI Predictive Analysis - Failed to train KPI models: The index into SearchResult is invalid.
rmeena21
Observer
04-15-2019
06:00 PM
Ola Splunkers,
Getting below error while training the KPI models for predictive analysis in ITSI...
Observed the following error in the job inspector log...
04-16-2019 00:46:24.673 ERROR DispatchThread - The index into SearchResult is invalid.
04-16-2019 00:46:24.674 INFO UserManager - Setting user context: masked
04-16-2019 00:46:24.674 INFO UserManager - Done setting user context: NULL -> maksed
04-16-2019 00:46:24.674 INFO UserManager - Unwound user context: masked -> NULL
04-16-2019 00:46:24.688 INFO DispatchThread - Downloading all remote search.log files took 0.014 seconds
04-16-2019 00:46:24.694 INFO DispatchManager - DispatchManager::dispatchHasFinished(id='1555375562.1700', username='masked')
04-16-2019 00:46:24.756 INFO UserManager - Unwound user context: masked -> NULL
04-16-2019 00:46:24.760 INFO PipelineComponent - Process delayed by 21.569 seconds, perhaps system was suspended?
04-16-2019 00:46:24.760 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: The index into SearchResult is invalid.
Following checks are already done:
- Splunkd process is running as splunk user
- No errors observed in the splunkd log.
Any help is appreciated.
Thanks..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
RickvdIJ
Explorer
08-13-2019
03:24 AM
Hi, I had the same issue with Splunk 7.0.3 and ITSI 4.2. Please check the issue ITSI-2309 on https://docs.splunk.com/Documentation/ITSI/4.0.3/ReleaseNotes/Knownissues#Predictive_Analytics. Let us know if that helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
szhou_splunk
Splunk Employee
05-15-2019
04:58 PM
Is this a search head cluster or single SH environment? Would you check if replicate.macros=true in distsearch.conf if you are running on search head cluster?