topic Re: Received unrecognized signature --splunk-cooked-mode-v3-- in Getting Data In

Received unrecognized signature --splunk-cooked-mode-v3--

dmlee — Fri, 27 May 2011 09:26:49 GMT

Hi,
I just upgraded two Splunk LWF 4.1.4 to Splunk UF 4.2.1 , other Splunk instances ( middle forwarders and indexers) are still in 4.1.4 .

I found there are many error messages in middle forwarder (after I upgraded LWF) , for example :

"05-27-2011 17:11:11.297 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v3--! from hostname=172.30.5.39, ip=172.30.5.39, port=50588"
"05-27-2011 17:11:04.822 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v3--! from hostname=172.30.5.39, ip=172.30.5.39, port=56588"
"05-27-2011 17:10:57.976 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v3--! from hostname=172.20.3.141, ip=172.20.3.141, port=47021"

172.20.3.141 and 172.30.5.39 are UF , above messages exist in middle forwarders' splunkd.log

any idea ? thanks

Re: Received unrecognized signature --splunk-cooked-mode-v3--

jbsplunk — Fri, 27 May 2011 18:02:54 GMT

You may want to review this answers post. It is likely relevant to the issue you are observing:

http://splunk-base.splunk.com/answers/10346/splunk-is-adding-weird-strings-like-_linebreakerx00x00-to-my-events-what-is-going-on

Re: Received unrecognized signature --splunk-cooked-mode-v3--

dmlee — Mon, 30 May 2011 03:01:34 GMT

thanks for your reply.

I think my issue may be is different , because I can see the events sent from UF was indexed properly ( I can search all events from UF ) .

Re: Received unrecognized signature --splunk-cooked-mode-v3--

sowings — Wed, 23 May 2012 21:32:52 GMT

Indexers should always be updated first; they're backward compatible with earlier forwarders, but that may not be true in reverse.