Getting Data In

TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":

aagehh
New Member

Hi

I get al lot of the following messages on my IX:
TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption":
Can anyone explain what this error messages indicate?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

The reason for this was that there was one wrongly named sourcetype (unsupported character) on props.conf.

Before upgrade to 7.x.x it was worked without any errors, but after update it start to write this message to internal log. It also gives error "WARN TcpOutputProc - Possible duplication of events with channel=source::tcp:10514". That also vanished after fixing sourcetype name.

--
Ismo

0 Karma

isoutamo
SplunkTrust
SplunkTrust

We have the same issue after updated from 6.6.5 to 7.3.2.

Also our HF -> IDX (cluster) traffic has stalled after that. HF said that IDX stops receiving events and on IDX side the haven't found any (real) reason for that yet. All resources seems to be ok even indexers didn't take events in.

r. Ismo

0 Karma

skalliger
SplunkTrust
SplunkTrust

I'd probably do the upgrade again, on both sides (IDX and HF). Are HF and IDX on the same version or did only the IDX got upgraded?

Skalli

0 Karma

isoutamo
SplunkTrust
SplunkTrust

All nodes has the same splunk version.

Ismo

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...