Deployment Architecture

BundleDataProcessor - File length is greater than 260

Gal123
Loves-to-Learn

Hi!

We deployed 2 new servers on Linux and cteated from them SHcluster.
Captain:
dynamic_captain : 1
elected_captain : Wed Feb 2 12:03:47 2022
id : 4F8CBE82-6302-4582-9FB7-48AC452AA43D
initialized_flag : 1
label : sphome5
mgmt_uri : https://%%%%%%%%%
min_peers_joined_flag : 1
rolling_restart_flag : 0
service_ready_flag : 1

Members:
sphome5
label : sphome5
mgmt_uri : https://%%%%%%%%%
mgmt_uri_alias : https://%%%%%%%%%
status : Up
sphome6
label : sphome6
last_conf_replication : Wed Feb 2 12:07:49 2022
mgmt_uri : https://%%%%%%%%%
mgmt_uri_alias : https://%%%%%%%%%
status : Up

After creating the SHcluster, it is assigned a long ID (4F8CBE82-6302-4582-9FB7-48AC452AA43D).

At now we need add older indexers via Search peers=>new search peers etc.
Older indexers deployed on Windows Servers 2016 and 2019
When I try add new search peer after create i see that replication status is Failed. In file splunkd.log on indexer i see following error:
BundleDataProcessor - File length is greater than 260, File creation may fail for C:\Program Files\Splunk\var\run\searchpeers\4F8CBE82-6302-4582-9FB7-48AC452AA43D-1643781827.82278d5fd22b73a1.tmp\apps\TA-alfa-telegram--connector\bin\ta_alfa_telegram_connector\aob_py2\cloudconnectlib\splunktacollectorlib\data_collection\ta_checkpoint_manager.py


How we can change ID SHcluster (6302-4582-9FB7-48AC452AA43D) to shorter?

And additional if is it inposable

Could you please give any recomendation how we can solution this problem?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

couple comments about your environment.

You should use at least 3 members on SHC as otherwise RAFT didn’t work when your SHC try to do captain election if one member goes down.

It’s against splunk recommendation/requirements to use Linux and Windows nodes on same cluster. So you should change indexer peers also to Linux.

If you want you could try this https://www.howtogeek.com/266621/how-to-make-windows-10-accept-file-paths-over-260-characters/ to allow more than 260 character long file names with path on windows, BUT do it on your own risk! 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...