Splunk Search

Could not read event. Results may be incomplete

arpit_arora
Explorer

Hello, I am seeing the following error while running Splunk search.

"idx=##INDEX NAME HERE## Could not read event: cd=0:33610. Results may be incomplete ! (logging only the first such error; enable DEBUG to see the rest)"

Any idea why it might be happening? How can I search more logging for this error.

Tags (1)

jmantor
Path Finder

I'm seeing a similar error. How would one ID the bucket that is a problem? What component should I put into Debug ?

0 Karma

claudio_manig
Communicator

Here's what i used-- kudos to splunk support for that one:
Ensure that you've got $SPLUNK_DB set in your environment (source $SPLUNK_HOME/bin/setSplunkEnv):

find $SPLUNK_DB -type f -wholename '/db/[dr]b_/rawdata/journal.gz' | perl -ne 'chomp;$d=$;$d=~s/journal.gz$//;if(-e "$d/slicesv2.dat"){@s=splunk cmd splunkd slices-dat-util --print \Q$d\E;if(${^CHILD_ERROR_NATIVE}){print STDERR "Error processing $d\n"}elsif($s[$#s]!~/\d+:(?:\s+\d+){2}\s+(\d+)/){print STDERR "Error parsing results from $d\n"}else{print "$d\n" if $1 >= ((stat "$")[7])}}'

cheers

0 Karma

C_HIEN
Path Finder

Try to stop the indexer and do a rebuild on the bucket. Therefore sometimes even if the rebuild seems successful the bucket is still corrupted (7.0.1)

0 Karma

jaho_splunk
Engager

I am also seeing this for the _internal index: [indexer] idx=_internal Could not read event: cd=(n/a). Results may be incomplete !

0 Karma

C_HIEN
Path Finder

The "Could not read event: cd=(n/a)" bug has been fixed in 7.0.1

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...