ConfPathMapper - Failed to open: /path/to/searchheadpooling/share/users/local/.savedsearches.conf.conf No such file or directory

[lmyrefelt]

Hi,

We are seeing this kind of "WARN" all to often in the splunkd.log:s on our searchheads.
ConfPathMapper - Failed to open: /path/to/searchheadpooling/share/users/local/.savedsearches.conf.conf No such file or directory .

Obviously this file dont excist and "never" had so why does it seem that splunk is trying to read in this and many other non-excisting files ?

I have also seen alot references agains come data.conf, which is another file i never seen or heard referenced before.

Soo i guess my question is, Why and how come splunk looking for this file/s ?

We have an environment with separate searchheads and indexers. Running on RedHat Lunix and splunk 5.0.3

[Lucas_K]

I'm seeing the same thing (v6.0.3).

Did you ever resolve this?

I'm even getting weird ones where it is logs that it is trying to read non .conf files.

ConfPathMapper - Failed to open: /mnt/pool/etc/apps/my_app/local/readme.conf: No such file or directory

In the dir itself it has

-rwxrwxr-x 1 splunk splunk  251 Feb  6 12:28 app.conf
drwxrwxr-x 3 splunk splunk 4096 Feb  5 13:45 data
-rwxrwxr-x 1 splunk splunk   98 Feb  5 15:42 readme.txt
-rwxrwxr-x 1 splunk splunk 5654 Feb  7 12:30 savedsearches.conf
-rwxrwxr-x 1 splunk splunk    0 Feb  5 14:05 viewstates.conf

EDIT : Actually, i think i know what this is. It seems that it will occur for every file within the local app dir's. It will try and open all files. The way in which it enumerates the file name is weird however. It seems to remove anything after the last "." and appends a .conf at the end.

ie. you have an old transforms.conf.20140612 for example. You made a copy before editing it from the command line.

Upon start up you will see an error regarding a file called transforms.conf.conf.

I noticed this behaviour when noticing all the different apps this was complaining about and what files they complained about.

The fix is to remove any non conf files from both default and local dirs.

TL;DR, this error can safely be ignored if your .conf files are named correctly even if you keep backup versions within your apps local dir.

[christian_clout]

I also saw this (6.2.1) on forwarders for apps that are no longer there. Has me scratching my head.