Reporting

Error in Splunkd.log

tkapoor
New Member

Hello,

I am seeing the following error in splunkd.log and my search is failing for same reason:

06-27-2012 23:20:28.135 +0100 ERROR SearchScheduler - failed to mkdir \splunk\var\run\splunk\dispatch\scheduler_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03: The filename or extension is too long.
06-27-2012 23:20:28.148 +0100 ERROR DispatchCommand - Failed to create a directory at \splunk\var\run\splunk\dispatch\scheduler
_nobody_cHJvcGhlY3ktcHJlbWlzZQ_U05NUCBNZWRpYSBTZXJ2ZXIgQXZlcmFnZSBSVFAgZGVsYXlzIGdyZWF0ZXIgdGhlbiAyIHBhY2tldHMgIE9JRDoxLjMuNi4xLjQuMS4yODMzNi42MDAuMy4zNg_at_1340835600_0feb5e210e3a6a03.

It is for a windows deployment and I see that with full path information total filename reaches to 281 characters and windows limit to 260 characters for filename.

Can you please suggest how does Splunk reaches to this file name and how can we restrict the file name to less than 260 char.

Tags (1)
0 Karma

marcusjudge
New Member

I had this problem, but only for searches with long stanza names in savedsearches.conf. Try reducing the name of your searches to be 97 chars or less.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...