01-11-2018 13:50:59.218 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/introspection/db
01-11-2018 13:50:59.222 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/introspection/kvstore.log'.
01-11-2018 13:50:59.231 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/introspection/http_event_collector_metrics.log'.
01-11-2018 13:50:59.246 +0000 INFO WatchedFile - Will begin reading at offset=467998 for file='/opt/splunk/var/log/introspection/disk_objects.log'.
01-11-2018 13:50:59.253 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/remote_searches.log'.
01-11-2018 13:50:59.294 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/django_error.log'.
01-11-2018 13:50:59.301 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/searchhistory.log'.
01-11-2018 13:50:59.361 +0000 INFO IndexWriter - Creating hot bucket=hot_v1_14, idx=_internal, event timestamp=1515678649, reason="suitable bucket not found, number of hot buckets=0, max=3"
01-11-2018 13:50:59.362 +0000 INFO DatabaseDirectoryManager - idx=_internal Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db', pendingBucketUpdates=0 . Reason='Adding bucket, bid=_internal~14~C94310F7-1F65-4765-8582-ED4C5D678114'
01-11-2018 13:50:59.362 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_internaldb/db
01-11-2018 13:50:59.371 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/export_metrics.log'.
01-11-2018 13:50:59.382 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/splunkd_stdout.log'.
01-11-2018 13:50:59.403 +0000 INFO WatchedFile - Will begin reading at offset=24933 for file='/opt/splunk/var/log/splunk/splunkd-utility.log'.
01-11-2018 13:50:59.415 +0000 INFO WatchedFile - Will begin reading at offset=1598 for file='/opt/splunk/var/log/splunk/splunkd_stderr.log'.
01-11-2018 13:50:59.429 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/mongod.log'.
01-11-2018 13:50:59.450 +0000 INFO WatchedFile - Will begin reading at offset=3848 for file='/opt/splunk/var/log/splunk/conf.log'.
01-11-2018 13:50:59.466 +0000 INFO WatchedFile - Will begin reading at offset=1320301 for file='/opt/splunk/var/log/splunk/audit.log'.
01-11-2018 13:50:59.515 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/django_access.log'.
01-11-2018 13:50:59.519 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunk/var/log/splunk/django_service.log'.
01-11-2018 13:50:59.725 +0000 INFO DatabaseDirectoryManager - idx=_audit Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/audit/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
01-11-2018 13:50:59.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/audit/db
01-11-2018 13:51:00.243 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=_audit~12~C94310F7-1F65-4765-8582-ED4C5D678114
01-11-2018 13:51:00.372 +0000 INFO ProcessTracker - (child_1Fsck) Fsck - (bloomfilter only) Rebuild for bucket='/opt/splunk/var/lib/splunk/_internaldb/db/db_1515678648_1515678534_13' took 16.08 milliseconds
01-11-2018 13:51:00.725 +0000 INFO DatabaseDirectoryManager - idx=_audit Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/audit/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1'
01-11-2018 13:51:00.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/audit/db
01-11-2018 13:51:01.357 +0000 INFO IntrospectionGenerator:resource_usage - RU_main - I-data gathering (Resource Usage) starting; period=10s
01-11-2018 13:51:01.379 +0000 INFO IntrospectionGenerator:resource_usage - RU_main - I-data gathering (IO Statistics) starting; interval=60s
01-11-2018 13:51:02.325 +0000 INFO ProcessTracker - (child_2_Fsck) Fsck - (bloomfilter only) Rebuild for bucket='/opt/splunk/var/lib/splunk/_introspection/db/db_1515678648_1515678545_12' took 4.254 milliseconds
01-11-2018 13:51:03.243 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=_internal~13~C94310F7-1F65-4765-8582-ED4C5D678114
01-11-2018 13:51:03.725 +0000 INFO DatabaseDirectoryManager - idx=_internal Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1'
01-11-2018 13:51:03.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_internaldb/db
01-11-2018 13:51:04.111 +0000 INFO TelemetryHandler - Telemetry Data Collection has been enabled for app=splunk_instrumentation for categories=License Usage.
01-11-2018 13:51:04.243 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=_introspection~12~C94310F7-1F65-4765-8582-ED4C5D678114
01-11-2018 13:51:04.724 +0000 INFO DatabaseDirectoryManager - idx=_introspection Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_introspection/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1'
01-11-2018 13:51:04.725 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_introspection/db
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Checking for localhost key pair
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Public key already exists: /opt/splunk/etc/auth/distServerKeys/trusted.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Reading public key for localhost: /opt/splunk/etc/auth/distServerKeys/trusted.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Finished reading public key for localhost: /opt/splunk/etc/auth/distServerKeys/trusted.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Reading private key for localhost: /opt/splunk/etc/auth/distServerKeys/private.pem
01-11-2018 13:51:29.306 +0000 INFO KeyManagerLocalhost - Finished reading private key for localhost: /opt/splunk/etc/auth/distServerKeys/private.pem
01-11-2018 13:51:59.726 +0000 INFO DatabaseDirectoryManager - idx=_internal Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
01-11-2018 13:51:59.726 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_internaldb/db
01-11-2018 13:51:59.727 +0000 INFO DatabaseDirectoryManager - idx=_introspection Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_introspection/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
01-11-2018 13:51:59.728 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/_introspection/db
... View more