Splunk Search

Seeing errors of form: ERROR NewSavedSearchMgr - Error base64 decoding section...

bohanlon_splunk
Splunk Employee
Splunk Employee

Why am I seeing errors of this form:
09-06-2016 08:42:25.189 +0000 ERROR NewSavedSearchMgr - Error base64 decoding section of remote_myhost1.company.com_SIDNumber: myhost1.company.com

0 Karma

bohanlon_splunk
Splunk Employee
Splunk Employee

Cause:
We do remote search.log fetching as the very last thing in a search process. This means it is done after ALL indexers have returned all their results. This means that one indexer can finish its search 20 minutes into the SH's search, but another indexer can finish 1 hour later. This means that we will be seeing the early finishing indexers reaping their search artifacts way before we fetch them causing the base64 errors. This is purely cosmetic. If the customer wants to stop seeing this error, they can update their limits.conf.

Workaround = Change limits.conf
Limits.conf
[search]
fetch_remote_search_log = disabled

Splunk references:
See SPL-111099 and SPL-128151.

effem
Communicator

Wouldnt it be better to hold the logfiles as long as the Searchhead has not all results? This way we are missing the remote-Search.log from the indexer everytime the indexers have a high difference in finishing their Search.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...