Deployment Architecture

How can I make dispatch file names shorter?

fsw2364
Path Finder

I have a dashboard with 3 panels, each with long involved search strings. Recently I started getting log errors that dispatch file (directory) names are too long. I checked and they are indeed 256 characters long - mostly a VERY long hash - which exceeds max length of 255 (rhel).

What can I do to make the dispatch names shorter?

0 Karma

alemarzu
Motivator

Hello there @jsw2364

You could save those search strings as reports firsts and then invoke them by a search reference tag in your dashboards, like this.

<row>
<panel>
      <single>
        <title>Actual</title>
        <search ref="my_report_name"></search>
        <option name="drilldown">none</option>
        ...
      </single>
    </panel>
</row>

Hope it helps.

0 Karma

fsw2364
Path Finder

Update:
I took a chance that the very long hash in the file name was base64 encoding. It turns out it is, and the filename actually contains several hashes. The details of what gets hashed can be found in https://www.splunk.com/blog/2012/09/12/deciphering-dispatch-directory-names.html.

My particular problem is threefold:

1) we authenticate with certs, so our Splunk usernames are very verbose x.500 style distinguished names (DNs), e.g.

      CN=john doe 54rtg37, OU=software division, O=mycompanyname , L=codeville, S=ma, C=US

which splunk has to hash to get a valid filename.

2) base64 encoding expands my already 73 character long DN into a 98 character hash

3) Splunk concatenates that hash into the dispatch file name TWICE (user running the search, user context its run in)

The result is a dispatch file name that's over the 255 character limit. In my case, the file name is exactly 256 characters long - so I missed by one character. The file doesn't get created, so the search fails.

I understand from a coworker that Splunk already has a trouble ticket open on this issue, but hasn't yet committed the fix to a release. Until then, I'm SOL.

Maybe I should change my name to Al Lee... B>D

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...