Reporting

Error in Splunkd.log

tkapoor
New Member

Hello,

I am seeing the following error in splunkd.log and my search is failing for same reason:

06-27-2012 23:20:28.135 +0100 ERROR SearchScheduler - failed to mkdir \splunk\var\run\splunk\dispatch\scheduler_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03: The filename or extension is too long.
06-27-2012 23:20:28.148 +0100 ERROR DispatchCommand - Failed to create a directory at \splunk\var\run\splunk\dispatch\scheduler
_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03.

It is for a windows deployment and I see that with full path information total filename reaches to 281 characters and windows limit to 260 characters for filename.

Can you please suggest how does Splunk reaches to this file name and how can we restrict the file name to less than 260 char.

Tags (1)
0 Karma

marcusjudge
New Member

I had this problem, but only for searches with long stanza names in savedsearches.conf. Try reducing the name of your searches to be 97 chars or less.

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...