Hallo,
i have a problem with my splunk server version 5.0.5.
The Problem looks similar to this one:
http://answers.splunk.com/answers/53230/vmware-app-scheduled-searches-are-crashing
There is an error every minute.
I have the following Apps installed:
Splunk for Microsoft Exchange,
Splunk Support LDAP,
S.o.S,
Sideviews Utils,
Google Maps,
Deployment Monitor,
Keywords,
IP Reputation
Has anyone a solution for the problem?
[build 179365] 2013-10-16 15:32:38
Access violation, cannot read at address [0x0000008000031841]
Exception address: [0x00000001407165FF]
Crashing thread: dispatch
MxCsr: [0x0000000000001F80]
SegDs: [0x000000000000002B]
SegEs: [0x000000000000002B]
SegFs: [0x0000000000000053]
SegGs: [0x000000000000002B]
SegSs: [0x000000000000002B]
SegCs: [0x0000000000000033]
EFlags: [0x0000000000010202]
Rsp: [0x00000000027C8810]
Rip: [0x00000001407165FF] ?
Dr0: [0x0000000000000000]
Dr1: [0x0000000000000000]
Dr2: [0x0000000000000000]
Dr3: [0x0000000000000000]
Dr6: [0x0000000000000000]
Dr7: [0x0000000000000000]
Rax: [0x0000008000031841]
Rcx: [0x0000000002C590A0]
Rdx: [0x00000000027C8860]
Rbx: [0x000000000333CD40]
Rbp: [0x000000000333D330]
Rsi: [0x0000000002C590A0]
Rdi: [0x0000000002C592E0]
R8: [0x0000000000000000]
R9: [0x0000000002C592E0]
R10: [0x0000000000000080]
R11: [0x0000000000000003]
R12: [0x0000000000000000]
R13: [0x0000000002C59370]
R14: [0x00000000027C8B90]
R15: [0x000000000333F470]
DebugControl: [0x000000014080D8F3]
LastBranchToRip: [0x0000000000000000]
LastBranchFromRip: [0x0000000000000000]
LastExceptionToRip: [0x0000000000000000]
LastExceptionFromRip: [0x0000000000000000]
OS: Windows
Arch: x86-64
Backtrace:
[0x00000001407165FF] ?
[0x00000001404D2030] ?
[0x00000001404615F2] ?
[0x0000000140D3CC6F] ?
[0x00000001403B767D] ?
[0x0000000140D3CC6F] ?
[0x0000000140CDE3D5] ?
[0x00000001403A21A6] ?
[0x00000001403B6B94] ?
[0x0000000140CDD725] ?
[0x0000000140CE23E8] ?
[0x0000000140CEB275] ?
[0x0000000140A08E02] ?
[0x00000001400040C7] ?
[0x00000000754737D7] endthreadex + 71/272
[0x0000000075473894] endthreadex + 260/272
[0x000000007772652D] BaseThreadInitThunk + 13/96
[0x000000007795C541] RtlUserThreadStart + 33/1024
Crash dump written to: C:\Program Files\Splunk\var\log\splunk\C__Program Files_Splunk_bin_splunkd_exe_crash-2013-10-16-15-32-38.dmp
SRVSPLUNK /6.1 Service Pack 1
Threads running: 3
argv: [splunkd search --id=SummaryDirector_1381930357.115 --maxbuckets=0 --ttl=30 --maxout=50000 --maxtime=8640000 --lookups=0 --reduce_freq=10 --user=splunk-system-user --pro --roles=admin:power:splunk-system-role:user]
terminating...
I´m not sure, but I think it was a problem with the IP Reputation App. I deactivated the app and the problem was solved.
So,it should caused by a related scheduled search, can we see some info related in splunkd.log?I'll check later
hi,I have the same problem with version 5.0.5. How to solve it.
I'm confident that this is crash has been already identified as SPL-68356 and fixed in Splunk 5.0.5.
Thanks for the answer. I opened a support case.
Have you filed a Support Case for this?