Splunk Search

Seeing errors of form: ERROR NewSavedSearchMgr - Error base64 decoding section...

bohanlon_splunk
Splunk Employee
Splunk Employee

Why am I seeing errors of this form:
09-06-2016 08:42:25.189 +0000 ERROR NewSavedSearchMgr - Error base64 decoding section of remote_myhost1.company.com_SIDNumber: myhost1.company.com

0 Karma

bohanlon_splunk
Splunk Employee
Splunk Employee

Cause:
We do remote search.log fetching as the very last thing in a search process. This means it is done after ALL indexers have returned all their results. This means that one indexer can finish its search 20 minutes into the SH's search, but another indexer can finish 1 hour later. This means that we will be seeing the early finishing indexers reaping their search artifacts way before we fetch them causing the base64 errors. This is purely cosmetic. If the customer wants to stop seeing this error, they can update their limits.conf.

Workaround = Change limits.conf
Limits.conf
[search]
fetch_remote_search_log = disabled

Splunk references:
See SPL-111099 and SPL-128151.

effem
Communicator

Wouldnt it be better to hold the logfiles as long as the Searchhead has not all results? This way we are missing the remote-Search.log from the indexer everytime the indexers have a high difference in finishing their Search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...