topic Re: TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption": in Getting Data In

TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":

aagehh — Wed, 11 Sep 2019 09:38:55 GMT

I get al lot of the following messages on my IX:
TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":
Can anyone explain what this error messages indicate?

Re: TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":

isoutamo — Thu, 21 Nov 2019 07:21:16 GMT

We have the same issue after updated from 6.6.5 to 7.3.2.

Also our HF -> IDX (cluster) traffic has stalled after that. HF said that IDX stops receiving events and on IDX side the haven't found any (real) reason for that yet. All resources seems to be ok even indexers didn't take events in.

r. Ismo

Re: TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":

skalliger — Fri, 22 Nov 2019 16:45:47 GMT

I'd probably do the upgrade again, on both sides (IDX and HF). Are HF and IDX on the same version or did only the IDX got upgraded?

Skalli

Re: TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":

isoutamo — Mon, 13 Jan 2020 10:33:53 GMT

All nodes has the same splunk version.

Ismo

Re: TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":

isoutamo — Mon, 13 Jan 2020 12:49:23 GMT

The reason for this was that there was one wrongly named sourcetype (unsupported character) on props.conf.

Before upgrade to 7.x.x it was worked without any errors, but after update it start to write this message to internal log. It also gives error "WARN TcpOutputProc - Possible duplication of events with channel=source::tcp:10514". That also vanished after fixing sourcetype name.

--
Ismo