Error in Splunkd.log

[tkapoor]

Hello,

I am seeing the following error in splunkd.log and my search is failing for same reason:

06-27-2012 23:20:28.135 +0100 ERROR SearchScheduler - failed to mkdir \splunk\var\run\splunk\dispatch\scheduler_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03: The filename or extension is too long.
06-27-2012 23:20:28.148 +0100 ERROR DispatchCommand - Failed to create a directory at \splunk\var\run\splunk\dispatch\scheduler_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03.

It is for a windows deployment and I see that with full path information total filename reaches to 281 characters and windows limit to 260 characters for filename.

Can you please suggest how does Splunk reaches to this file name and how can we restrict the file name to less than 260 char.

[marcusjudge]

I had this problem, but only for searches with long stanza names in savedsearches.conf. Try reducing the name of your searches to be 97 chars or less.