Somehow, Splunk MetaData has become corrupt. My event counts are all off. What do I do?
If you have access to the filesystem, you can try forcing Splunk to rebuild the data files. There are 2 ways to do this:
1) Delete the the *.data files in $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ (there should exist Hosts.data, Sources.data and SourceTypes.data files) and then Restart your Splunk instance.
2) cd to $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ and 'touch meta.dirty'. Splunk should rebuild the *.data files within a few seconds. This method does not require a restart.
This question is really trying to say "All the numbers in the summary page went all weird".
If you have access to the filesystem, you can try forcing Splunk to rebuild the data files. There are 2 ways to do this:
1) Delete the the *.data files in $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ (there should exist Hosts.data, Sources.data and SourceTypes.data files) and then Restart your Splunk instance.
2) cd to $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ and 'touch meta.dirty'. Splunk should rebuild the *.data files within a few seconds. This method does not require a restart.
Another, more manual method to rebuild bucket-level metadata files is to use the recover-metadata command. For details, see http://splunk-base.splunk.com/answers/5374/how-to-quickly-validate-the-metadata-files-of-a-given-ind...
Note, if you update cold buckets, you still need to touch the meta.dirty file in the hot/warm directory, even if it is on a different filesystem. Touching meta.dirty in the cold folder has no effect.