Reporting

Error in Splunkd.log

tkapoor
New Member

Hello,

I am seeing the following error in splunkd.log and my search is failing for same reason:

06-27-2012 23:20:28.135 +0100 ERROR SearchScheduler - failed to mkdir \splunk\var\run\splunk\dispatch\scheduler_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03: The filename or extension is too long.
06-27-2012 23:20:28.148 +0100 ERROR DispatchCommand - Failed to create a directory at \splunk\var\run\splunk\dispatch\scheduler
_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03.

It is for a windows deployment and I see that with full path information total filename reaches to 281 characters and windows limit to 260 characters for filename.

Can you please suggest how does Splunk reaches to this file name and how can we restrict the file name to less than 260 char.

Tags (1)
0 Karma

marcusjudge
New Member

I had this problem, but only for searches with long stanza names in savedsearches.conf. Try reducing the name of your searches to be 97 chars or less.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...