Restart splunk

[chunmingpoxiao]

..when i restart splunk,i can't see buckets moved into HDFS.

[chunmingpoxiao]

i can't see other buckets

[petterik]

@chunmingpoxiao see the comment here: #63 (comment)

I'm assuming that's your problem, since it seems like your configuration is correct because you have some buckets in HDFS.
Freeze more buckets and you should eventually see everything in HDFS.

Can you explain what you mean by "I cant' see other buckets"?

[chunmingpoxiao]

..... i try again,Shuttl transfers a bucket but not transfer all the buckets in "safe-bucket" directory...lost 0，1，2，4，6 CSV 。。it never transfer all the buckets in the "safe-buckets" directory to HDFS.

[petterik]

See if you can find anything in the logs at $SPLUNK_HOME/var/logs/splunk/shuttl.log. You might be able to find out what happened to bucket 0, 1, 2, 4 and 6.
This is strange behavior. I've never seen it before.

[chunmingpoxiao]

@petterik can i set the field of the csv file.......you says:SpIF has the following fields:_time ,source ,host ,sourcetype,_raw,_meta .??...

[chunmingpoxiao]

@petterik

what cause this error?