topic Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641 in Splunk Search

I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

mikehsieh — Fri, 19 Jun 2015 18:15:01 GMT

I am getting ERROR HttpListener when I search and do not get any data - this error is in splunk server 6.2.3

06-19-2015 13:54:00.722 -0400 ERROR HttpListener - Exception while processing request from 11.48.178.51 for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+host%3D%2211.48.222.101%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1434736433926: Connection closed by peer
06-19-2015 13:54:00.722 -0400 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+host%3D%2211.48.222.101%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1434736433926 sent a 0 byte response after earlier claiming a Content-Length of 641!

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

l-mss-n3 — Tue, 28 Jul 2015 17:13:09 GMT

I have been working with the same problem, Did you found any solution?

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

karthikannan — Wed, 16 Sep 2015 00:26:10 GMT

Does anybody know the solution for this issue. I'm facing the same....

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

mekamundia — Mon, 21 Sep 2015 10:08:24 GMT

I am receiving this error every day too

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

gsawyer1 — Fri, 11 Dec 2015 15:10:17 GMT

I had a similar error and was unable to login to my Splunk instance via web. I cleared the cache and all history etc from the browser, restarted the computer, and lo and behold, problem disappeared. But, my errors were related to the display of webfonts when I tried to view an XML dashboard's source in plaintext, and resulted in Winsock error 10045 (connection reset). They ended with:
sent a 0 byte response after earlier claiming a Content-Length of xxxx!

So maybe that will help you or someone else....

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

klsio — Tue, 26 Apr 2016 06:42:46 GMT

I have same error..

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

despachoSTD — Wed, 04 May 2016 15:24:12 GMT

Chech if you have disabled (or even deleted) the default data input pointing at:

$SPLUNK_HOME$/var/spool/dbmon/*.dbmonevt"

or have any problem in creating files in that location.

It turns out that the dbx app writes the results in that kind of files in that dir, and later Splunk indexes (and deletes) that files to read the results.

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

despachoSTD — Wed, 04 May 2016 15:35:47 GMT

Beware that if you simply start the data input with all the files in the dir, the system will perform all the pending indexings, potentially causing licensing issues and/or repetitions.

If you want to start clean, stop splunk, delete all the files in the dir, start splunk and enable the data input again.

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641

thashmi — Mon, 24 Apr 2023 12:43:52 GMT

If you could brief about your webui not loading issue and how did you resolve it.

Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641

PickleRick — Mon, 24 Apr 2023 16:15:16 GMT

Look at the dates 🙂

You're responding to an almost 8-years old thread regarding a 6.x Splunk version.

I wouldn't expect a reasonable response here.