Monitoring Splunk

Concerns about continuously receiving several error messages in splunkd.log

bkatzlin
Explorer

Hello,

I'm continuously experiencing several error messages in splunkd.log such as:

ERROR BucketMover - Unable to parse bucket ID from path="..."

In this forum I only found previous solutions saying like "This issue has been fixed in version 6.x" - but I'm currently on 7.2.0

  1. Should I be concerned about these messages?
  2. Would this error affect my data retention?
  3. And finally - how could the issue be fixed?

Regards,
Bernd

Labels (2)
0 Karma
1 Solution

bkatzlin
Explorer

Thanks to Skalli's comment I was able to find a INFO message corresponding to each ERROR, saying that the bucket issue has somehow been resolved by "AsyncFreezer". I should have noticed this immediately, sorry.
Thus I'd prefer to take these errors easy and see whether they will disappear at the next upgrade.
Thanks!

View solution in original post

0 Karma

bkatzlin
Explorer

Thanks to Skalli's comment I was able to find a INFO message corresponding to each ERROR, saying that the bucket issue has somehow been resolved by "AsyncFreezer". I should have noticed this immediately, sorry.
Thus I'd prefer to take these errors easy and see whether they will disappear at the next upgrade.
Thanks!

0 Karma

skalliger
SplunkTrust
SplunkTrust

Good to know, thanks for the feedback. Sometimes there are errors that shouldn't be displayed as errors. 🙂

Skalli

0 Karma

amitm05
Builder

I'd suggest to mark the answer if this problem is getting auto fixed. So its easier for others to follow up on the correct thread. Thanks

0 Karma

amitm05
Builder

@bkatzlin
You have omitted the bucket path in your question. It'll help to know that which buckets (hot, warm Or cold) are getting impacted.
You might want to check for permissions of Splunk on the storage locations (However if in the first place splunk was able to write there, I'm least expecting to find this to be the cause but no harm cross checking).

And yes, about retention - If your buckets keep failing to roll, you might start experiencing the performance problems and eventually the disk usage.

Ques - Are you working with a idx cluster Or a standalone box ? You might want to check which instances are throwing these errors if you are working with a cluster.

Let me know. Thanks

0 Karma

bkatzlin
Explorer

Thanks for giving me some directions.
Well, it's a idx cluster, Splunk version 7.2.0 as said, and the messages are seen on all cluster members.
Actually the error seems to me related to data model acceleration, since all path="..." names have in common:

.../<index_name>/datamodel_summary/.../DM_Splunk_SA_CIM_Web

Any ideas?

0 Karma

amitm05
Builder

Please provide the full error message. Earlier you didnt mention anything about the DataModel in your error

0 Karma

skalliger
SplunkTrust
SplunkTrust

I'd suggest upgrading to the latest 7.2 which is 7.2.7 right now. Don't just do .0 releases.
Do you have other Error log messages around that time when it happens?

Skalli

bkatzlin
Explorer

I found that these BucketMover ERROR records are followed by a INFO message saying:
INFO BucketMover - AsyncFreezer freeze succeedded for bkt='...'
So, without knowing any internals, I'd guess that the AsyncFreezer has successfully fixed the affected bucket and everything's ok.

0 Karma

skalliger
SplunkTrust
SplunkTrust

Guess I forgot to add that. Yea, seems like a bug which might be gone after doing an upgrade. 🙂

Skalli

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...