Hi,
I installed S.o.S to two of my Splunk indexer. One works fine and another one shows following error when I go to Scheduler Activity:
Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatchtmp/subsearch_1349746656.17_1349746657.1/prereport_0.csv.gz'
Due to this error, the Scheduler Activity shows nothing except following message:
The job appears to have expired or has been canceled. Splunk could not retrieve data for this search.
Does anybody know what this is? And how to work around it?
Thanks