TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":

[aagehh]

Hi

I get al lot of the following messages on my IX:
TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":
Can anyone explain what this error messages indicate?

[isoutamo]

The reason for this was that there was one wrongly named sourcetype (unsupported character) on props.conf.

Before upgrade to 7.x.x it was worked without any errors, but after update it start to write this message to internal log. It also gives error "WARN TcpOutputProc - Possible duplication of events with channel=source::tcp:10514". That also vanished after fixing sourcetype name.

--
Ismo

[isoutamo]

We have the same issue after updated from 6.6.5 to 7.3.2.

Also our HF -> IDX (cluster) traffic has stalled after that. HF said that IDX stops receiving events and on IDX side the haven't found any (real) reason for that yet. All resources seems to be ok even indexers didn't take events in.

r. Ismo

[skalliger]

I'd probably do the upgrade again, on both sides (IDX and HF). Are HF and IDX on the same version or did only the IDX got upgraded?

Skalli

[isoutamo]

All nodes has the same splunk version.

Ismo