Deployment Architecture

How can I make dispatch file names shorter?

fsw2364
Path Finder

I have a dashboard with 3 panels, each with long involved search strings. Recently I started getting log errors that dispatch file (directory) names are too long. I checked and they are indeed 256 characters long - mostly a VERY long hash - which exceeds max length of 255 (rhel).

What can I do to make the dispatch names shorter?

0 Karma

alemarzu
Motivator

Hello there @jsw2364

You could save those search strings as reports firsts and then invoke them by a search reference tag in your dashboards, like this.

<row>
<panel>
      <single>
        <title>Actual</title>
        <search ref="my_report_name"></search>
        <option name="drilldown">none</option>
        ...
      </single>
    </panel>
</row>

Hope it helps.

0 Karma

fsw2364
Path Finder

Update:
I took a chance that the very long hash in the file name was base64 encoding. It turns out it is, and the filename actually contains several hashes. The details of what gets hashed can be found in https://www.splunk.com/blog/2012/09/12/deciphering-dispatch-directory-names.html.

My particular problem is threefold:

1) we authenticate with certs, so our Splunk usernames are very verbose x.500 style distinguished names (DNs), e.g.

      CN=john doe 54rtg37, OU=software division, O=mycompanyname , L=codeville, S=ma, C=US

which splunk has to hash to get a valid filename.

2) base64 encoding expands my already 73 character long DN into a 98 character hash

3) Splunk concatenates that hash into the dispatch file name TWICE (user running the search, user context its run in)

The result is a dispatch file name that's over the 255 character limit. In my case, the file name is exactly 256 characters long - so I missed by one character. The file doesn't get created, so the search fails.

I understand from a coworker that Splunk already has a trouble ticket open on this issue, but hasn't yet committed the fix to a release. Until then, I'm SOL.

Maybe I should change my name to Al Lee... B>D

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...