Good morning all.
I'm trying to develop an application using splunk 4.1.1
In order to verify the results of a search, suddenly, while Splunk was executing that search, appeared the following message:
The appserver was unable to connect to splunkd. Check if splunkd is still running. ([Errno 10055. An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full).
By CLI I tried to restart splunk several times but nothing. It seems to be fixed after a reboot of the system. Before to reboot I got also the splash screen "The splunkd daemon is no longer responding and may have crashed. The UI is fine, so check the splunkd.log .
I checked that log and there were errors regarding metedatas processing into the var/log (all regarding csv files):
A couples of errors into splunkd.log as example:
05-02-2010 21:00:39.350 WARN DispatchCommand - could not read metadata file: C:\Program Files\Splunk\var\run\splunk\dispatch\1272826794.2\metadata.csv
05-02-2010 21:01:09.370 WARN DispatchCommand - could not read metadata file: C:\Program Files\Splunk\var\run\splunk\dispatch\1272826261.1\metadata.csv
....web_acces.log also presents this:
2010-05-02 21:25:14,618 ERROR [4bddd197ac23a2ba8] root:120 - ENGINE: Set handler for console events.
Since that search will be potentially used by a large numbers of users does anybody suggest me the meaning of ERRNO10055?
On my system (Vista 64,with 4 Giga RAM) was running just Splunk 4.1.1, the antivirus and the OS.
There is a workaround to solve that issue without rebooting system?
There are other check I should perform to investigate what happens?
Thanks in advance for your help.
nik
