Forwarder splunkd.log filled with ERROR SQLitePersistentStorageImpl - Error inserting....SQL logic error or missing database

[Ellen]

Just installed Windows 5.0.2 forwarders and the data is getting successfully indexed and searched from Linux 5.0.2 indexers.
However I see the forwarder's splunkd.log has tons of the following error message repeated frequently.

There are no other errors that precede or follow it. Is this harmless or what?

ERROR SQLitePersistentStorageImpl - [] Error inserting  _pInsertStatement in SQLitePersistentStorageImpl::write: SQL logic error or missing database

[Azeemering]

This should be fixed now with the release of Splunk 6.4.2:

http://docs.splunk.com/Documentation/Splunk/6.4.2/ReleaseNotes/6.4.2

[Ellen · Accepted solution]

This is a benign error and known issue, SPL-61702 and tentatively targeted to be fixed in an upcoming maintenance release beyond 4.3.5+ and 5.0.2+

In the meanwhile to disable error logging of this module, add the following stanza entry to a new or existing %SPLUNK_HOME%\etc\log-local.cfg

[splunkd]
category.SQLitePersistentStorageImpl = FATAL

Restart of Splunk will be necessary.

Note: if the forwarder is Splunk Web accessible, you can make the change via
System settings > System Logging search for SQLitePersistentStorageImpl and change from default WARN to FATAL
This will make the change without a forwarder restart but will not be persistent the next time splunkd is restarted.