topic Re: WinEventLogChannel - saveCheckpointStr : Unable to write checkpoint with a null string in Getting Data In

WinEventLogChannel - saveCheckpointStr : Unable to write checkpoint with a null string

dmlee — Tue, 20 Sep 2011 04:42:32 GMT

Hi, there are lots of ERROR messages in splunkd.log (version 4.2.3 , play as LightForwarder)

and this Splunk LWF send all of the WinEventLog to indexer again and again , so there are many duplicate events in indexer.

09-20-2011 12:15:49.744 +0800 ERROR WinEventLogChannel - saveCheckpointStr: Unable to write checkpoint with a null string
09-20-2011 12:15:49.744 +0800 ERROR WinEventLogChannel - WELCheckPoint::save: Failed to save checkpoint file='': 操作順利完成(success)。
09-20-2011 12:15:49.837 +0800 ERROR WinEventLogChannel - saveCheckpointStr: Failed to rename checkpoint file '.tmp' -> '': 系統找不到指定的路徑(can't find the path)

。
any idea about it? thanks

Re: WinEventLogChannel - saveCheckpointStr : Unable to write checkpoint with a null string

jumper4000 — Sat, 13 Oct 2012 00:49:05 GMT

I'm having the same issue. Any help would be appreciated.

Re: WinEventLogChannel - saveCheckpointStr : Unable to write checkpoint with a null string

jrodman — Sat, 11 Oct 2014 07:47:52 GMT

Clearly this was a defect. Given how much code in the WinEventLog input in general, and the checkpointing in specific, it is nearly impossible that this bug still exists. (Though if this class of problem arises please do contact support.)