Reporting

Error in Splunkd.log

tkapoor
New Member

Hello,

I am seeing the following error in splunkd.log and my search is failing for same reason:

06-27-2012 23:20:28.135 +0100 ERROR SearchScheduler - failed to mkdir \splunk\var\run\splunk\dispatch\scheduler_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03: The filename or extension is too long.
06-27-2012 23:20:28.148 +0100 ERROR DispatchCommand - Failed to create a directory at \splunk\var\run\splunk\dispatch\scheduler
_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03.

It is for a windows deployment and I see that with full path information total filename reaches to 281 characters and windows limit to 260 characters for filename.

Can you please suggest how does Splunk reaches to this file name and how can we restrict the file name to less than 260 char.

Tags (1)
0 Karma

marcusjudge
New Member

I had this problem, but only for searches with long stanza names in savedsearches.conf. Try reducing the name of your searches to be 97 chars or less.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...