Deployment Architecture

BundleDataProcessor - File length is greater than 260

Gal123
Loves-to-Learn

Hi!

We deployed 2 new servers on Linux and cteated from them SHcluster.
Captain:
dynamic_captain : 1
elected_captain : Wed Feb 2 12:03:47 2022
id : 4F8CBE82-6302-4582-9FB7-48AC452AA43D
initialized_flag : 1
label : sphome5
mgmt_uri : https://%%%%%%%%%
min_peers_joined_flag : 1
rolling_restart_flag : 0
service_ready_flag : 1

Members:
sphome5
label : sphome5
mgmt_uri : https://%%%%%%%%%
mgmt_uri_alias : https://%%%%%%%%%
status : Up
sphome6
label : sphome6
last_conf_replication : Wed Feb 2 12:07:49 2022
mgmt_uri : https://%%%%%%%%%
mgmt_uri_alias : https://%%%%%%%%%
status : Up

After creating the SHcluster, it is assigned a long ID (4F8CBE82-6302-4582-9FB7-48AC452AA43D).

At now we need add older indexers via Search peers=>new search peers etc.
Older indexers deployed on Windows Servers 2016 and 2019
When I try add new search peer after create i see that replication status is Failed. In file splunkd.log on indexer i see following error:
BundleDataProcessor - File length is greater than 260, File creation may fail for C:\Program Files\Splunk\var\run\searchpeers\4F8CBE82-6302-4582-9FB7-48AC452AA43D-1643781827.82278d5fd22b73a1.tmp\apps\TA-alfa-telegram--connector\bin\ta_alfa_telegram_connector\aob_py2\cloudconnectlib\splunktacollectorlib\data_collection\ta_checkpoint_manager.py


How we can change ID SHcluster (6302-4582-9FB7-48AC452AA43D) to shorter?

And additional if is it inposable

Could you please give any recomendation how we can solution this problem?

0 Karma

Mark0Community
Loves-to-Learn

Hi, it really did my my headthis path thing, but I found a way, I tried LongPath Tool Program and that sorted it.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

couple comments about your environment.

You should use at least 3 members on SHC as otherwise RAFT didn’t work when your SHC try to do captain election if one member goes down.

It’s against splunk recommendation/requirements to use Linux and Windows nodes on same cluster. So you should change indexer peers also to Linux.

If you want you could try this https://www.howtogeek.com/266621/how-to-make-windows-10-accept-file-paths-over-260-characters/ to allow more than 260 character long file names with path on windows, BUT do it on your own risk! 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...