Getting Data In

Blank source and sourcetype?

Jason
Motivator

I thought Splunk always assigned a source and at least guessed a sourcetype for ALL data.

Why am I seeing data in Splunk with no source or sourcetype?

1 Solution

Mackenzie
Engager

This can happen when metadata gets corrupted in Splunk. It's related to an issue when using the Delete command. (i've seen this in 4.2). Engineering is aware of the problem and working on a fix.

You can verify this by looking in your indexers splunkd.log for 'safeService' warnings. If you see these, stop splunk and issue:

$SPLUNK_HOME/bin/splunk cmd splunkd fsck --all --mode metadata --repair

This will rebuild your metadata files for each of your indexes. It's similar to the 'recovery' process you see during unclean shutdowns.

View solution in original post

Jason
Motivator

Just occasional data. I couldn't discern a specific pattern.

0 Karma

Mackenzie
Engager

This can happen when metadata gets corrupted in Splunk. It's related to an issue when using the Delete command. (i've seen this in 4.2). Engineering is aware of the problem and working on a fix.

You can verify this by looking in your indexers splunkd.log for 'safeService' warnings. If you see these, stop splunk and issue:

$SPLUNK_HOME/bin/splunk cmd splunkd fsck --all --mode metadata --repair

This will rebuild your metadata files for each of your indexes. It's similar to the 'recovery' process you see during unclean shutdowns.

piebob
Splunk Employee
Splunk Employee

can you give some details? what data are you not seeing this for?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...