All the numbers in the summary page went all weird (was: Corrupt MetaData?)

[the_wolverine]

Somehow, Splunk MetaData has become corrupt. My event counts are all off. What do I do?

[jrodman]

This question is really trying to say "All the numbers in the summary page went all weird".

[the_wolverine · Accepted solution]

If you have access to the filesystem, you can try forcing Splunk to rebuild the data files. There are 2 ways to do this:

1) Delete the the *.data files in $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ (there should exist Hosts.data, Sources.data and SourceTypes.data files) and then Restart your Splunk instance.

2) cd to $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ and 'touch meta.dirty'. Splunk should rebuild the *.data files within a few seconds. This method does not require a restart.

[hexx]

Another, more manual method to rebuild bucket-level metadata files is to use the recover-metadata command. For details, see http://splunk-base.splunk.com/answers/5374/how-to-quickly-validate-the-metadata-files-of-a-given-ind...

[Jason]

Note, if you update cold buckets, you still need to touch the meta.dirty file in the hot/warm directory, even if it is on a different filesystem. Touching meta.dirty in the cold folder has no effect.