WinEventLogChannel - saveCheckpointStr : Unable to write checkpoint with a null string

[dmlee]

Hi, there are lots of ERROR messages in splunkd.log (version 4.2.3 , play as LightForwarder)

and this Splunk LWF send all of the WinEventLog to indexer again and again , so there are many duplicate events in indexer.

09-20-2011 12:15:49.744 +0800 ERROR WinEventLogChannel - saveCheckpointStr: Unable to write checkpoint with a null string
09-20-2011 12:15:49.744 +0800 ERROR WinEventLogChannel - WELCheckPoint::save: Failed to save checkpoint file='': 操作順利完成(success)。
09-20-2011 12:15:49.837 +0800 ERROR WinEventLogChannel - saveCheckpointStr: Failed to rename checkpoint file '.tmp' -> '': 系統找不到指定的路徑(can't find the path)

。
any idea about it? thanks

[jrodman · Accepted solution]

Clearly this was a defect. Given how much code in the WinEventLog input in general, and the checkpointing in specific, it is nearly impossible that this bug still exists. (Though if this class of problem arises please do contact support.)

[jumper4000]

I'm having the same issue. Any help would be appreciated.