Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- ERROR StreamedSearch File name too long
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ERROR StreamedSearch File name too long
Hello,
We are running 4.2.5-113966.
Scanning splunkd.log, I see we are getting LOTS of errors (~2600 yesterday) of the form (always a pair of errors):
02-24-2012 08:01:54.076 -0600 ERROR StreamedSearch - preparing to stream search, failed to mkdir /usr2/splunkshare1/splunk-ui/var/run/splunk/dispatch/remote_<name of the other Splunk Search Head>-splnkcpo_subsearch_subsearch_scheduler_ nobody SplunkDeploymentMonitor_RE0gc291cmNldHlwZXMgdG9vIGxpdHRsZSBkYXRh_at_1330092000_8faa392bb73975e
f_1330092112.2_1330092112.3<name of THIS Splunk Search Head>: File name too long
02-24-2012 08:01:54.077 -0600 ERROR SearchResults - Unable to open output file: path=/usr2/splunkshare1/splunk-ui/var/run/splunk/dispatch/remote_<name of the other Splunk Search Head>-splnkcpo_subsearch_subsearch_scheduler_ nobody SplunkDeploymentMonitor_RE0gc291cmNldHlwZXMgdG9vIGxpdHRsZSBkYXRh_at_1330092000_8faa392bb73975ef_1330092112
.2_1330092112.3<name of THIS Splunk Search Head>-splnkcpo/info.csv.tmp error=File name too long
It would seem that there is some mechanism / algorithm that is generating these long file names -- longer than Linux can handle.
Any ideas??
Thx!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Long Path Tool is useful here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have to checkout long path tool, it's an automated software for this type of errors
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Long Path Tool helped me in this situation. http://PathTooDeep.com
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Long Path Tool helped me in this situation. http://PathTooDeep.com
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
It smells like a http restriction, instead of OS filesystem restriction. Splunk use REST API to communicate with splunkd (default 8089/tcp).
The dispatch sid name is a little strange;
But, this should not happen in 4.2.5 because the sid of dispatched search should not use <name of THIS Splunk Search Head>-splunkcpo
Are you using the same version 4.2.5 for both Splunk instance?
Maybe you should file a Support case to ask to investigate more about the issue.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Manage Edge Processor pipelines end to end with APIs
Splunk Brings Proof of Control to Digital Asset Transfers
Manage Ingest Processor pipelines end to end with APIs
