I keep getting these in the logs for a particular client where we have setup a scripted input which delivers the data through the light forwarder.
11-03-2010 16:13:24.763 WARN PipelineInputChannel - channel "source::tcp:9903|host::PRDBNN301||remoteport::52186" ended without a done-key 11-03-2010 16:13:24.763 WARN PipelineInputChannel - channel "source::s2s|host::PRDBNN301|s2s|remoteport::52186" ended without a done-key 11-03-2010 16:13:24.763 WARN PipelineInputChannel - channel "source::wmi|host::PRDBNN301|wmi|remoteport::52186" ended without a done-key
The data from this client does not seem to reach the indexer (at least I cant search for it). This seems to work well in development.
Any pointers would be appreciated.
Splunk 4.1.5 Windows 2003 R2
Additional explanation is available here:
http://answers.splunk.com/questions/7365/ended-without-a-done-key/7397#7397
I changed from the light forwarder to the heavy one and things work well.