Monitoring Splunk

ERROR StreamedSearch File name too long

Path Finder


We are running 4.2.5-113966.

Scanning splunkd.log, I see we are getting LOTS of errors (~2600 yesterday) of the form (always a pair of errors):

02-24-2012 08:01:54.076 -0600 ERROR StreamedSearch - preparing to stream search, failed to mkdir /usr2/splunkshare1/splunk-ui/var/run/splunk/dispatch/remote_<name of the other Splunk Search Head>-splnkcpo_subsearch_subsearch_scheduler_ nobody SplunkDeploymentMonitor_RE0gc291cmNldHlwZXMgdG9vIGxpdHRsZSBkYXRh_at_1330092000_8faa392bb73975e
<name of THIS Splunk Search Head>: File name too long

02-24-2012 08:01:54.077 -0600 ERROR SearchResults - Unable to open output file: path=/usr2/splunkshare1/splunk-ui/var/run/splunk/dispatch/remote_<name of the other Splunk Search Head>-splnkcpo_subsearch_subsearch_scheduler_ nobody SplunkDeploymentMonitor_RE0gc291cmNldHlwZXMgdG9vIGxpdHRsZSBkYXRh_at_1330092000_8faa392bb73975ef_1330092112
<name of THIS Splunk Search Head>-splnkcpo/info.csv.tmp error=File name too long

It would seem that there is some mechanism / algorithm that is generating these long file names -- longer than Linux can handle.

Any ideas??


Tags (2)
0 Karma

New Member

Long Path Tool is useful here

0 Karma

New Member

You have to checkout long path tool, it's an automated software for this type of errors

0 Karma

New Member

Long Path Tool helped me in this situation.

0 Karma

New Member

Long Path Tool helped me in this situation.

0 Karma

Splunk Employee
Splunk Employee


It smells like a http restriction, instead of OS filesystem restriction. Splunk use REST API to communicate with splunkd (default 8089/tcp).

The dispatch sid name is a little strange;

But, this should not happen in 4.2.5 because the sid of dispatched search should not use <name of THIS Splunk Search Head>-splunkcpo

Are you using the same version 4.2.5 for both Splunk instance?

Maybe you should file a Support case to ask to investigate more about the issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...