How can I make dispatch file names shorter?

[fsw2364]

I have a dashboard with 3 panels, each with long involved search strings. Recently I started getting log errors that dispatch file (directory) names are too long. I checked and they are indeed 256 characters long - mostly a VERY long hash - which exceeds max length of 255 (rhel).

What can I do to make the dispatch names shorter?

[alemarzu]

Hello there @jsw2364

You could save those search strings as reports firsts and then invoke them by a search reference tag in your dashboards, like this.

<row>
<panel>
      <single>
        <title>Actual</title>
        <search ref="my_report_name"></search>
        <option name="drilldown">none</option>
        ...
      </single>
    </panel>
</row>

Hope it helps.

[fsw2364]

Update:
I took a chance that the very long hash in the file name was base64 encoding. It turns out it is, and the filename actually contains several hashes. The details of what gets hashed can be found in https://www.splunk.com/blog/2012/09/12/deciphering-dispatch-directory-names.html.

My particular problem is threefold:

1) we authenticate with certs, so our Splunk usernames are very verbose x.500 style distinguished names (DNs), e.g.

      CN=john doe 54rtg37, OU=software division, O=mycompanyname , L=codeville, S=ma, C=US

which splunk has to hash to get a valid filename.

2) base64 encoding expands my already 73 character long DN into a 98 character hash

3) Splunk concatenates that hash into the dispatch file name TWICE (user running the search, user context its run in)

The result is a dispatch file name that's over the 255 character limit. In my case, the file name is exactly 256 characters long - so I missed by one character. The file doesn't get created, so the search fails.

I understand from a coworker that Splunk already has a trouble ticket open on this issue, but hasn't yet committed the fix to a release. Until then, I'm SOL.

Maybe I should change my name to Al Lee... B>D