Getting Data In

When should I restore from backup?

pdevlin
Explorer

What events should I be watching for in my Splunk logs? Does anyone have a list of specific error codes that would indicate the need to restore an index?

Tags (3)

gkanapathy
Splunk Employee
Splunk Employee

I guess I'm not sure why you want to restore an index from backup. It's an extremely abnormal condition, and I suppose that many things that went wrong could cause it, but if it did, someone is going to see something go wrong in the application, not the log.

pdevlin
Explorer

Index corruption, disk errors or VM/OS failures that cause file corruption, etc. I'd like to monitor Splunk logs for those specific errors that indicate an index is corrupt and/or not usable. Yes we would notice in the application that something is wrong but knowing the exact errors which indicate a corrupt index is vital for basic maintenance and support. Do you know if there is a complete list of Splunk error codes and what they mean?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...