Splunk Search

Possible Bad Pointer in Index or Database?

dladkisson
New Member

After a system reboot for updates, SplunkWeb didn't not relaunch successfully after restart. After letting it sit for a few minutes SplunkWeb did finally launch however it appears that perhaps there was a corruption in the event database.

All I am feeding into it right now is Cisco IDS events using the Splunk_CiscoIPS plugin; latest versions of both the plugin and Splunk.

I cannot seem to find in the documentation a way to check the event database for errors nor figure out which database may even be affected.

If I start a query that overlaps the 15/20 minutes where the Splunkweb was down, the search hangs when it gets to that period. Searching outside the 'damaged' period returns results just fine.

Any suggestions would be greatly appreciated.

Tags (2)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

It sounds like you may have a corrupted bucket. No real great answer here, except you probably would be best off to open a support case.

You could try quasi-randomly moving buckets out of your index directories. The dbinspect command might help you figure out which buckets match the time ranges of interest. Obviously, this approach may cause you to have data loss, where support might (if you're lucky) be able to avoid that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...