Splunk Dev

Cannot issue any Splunk CLI command without “…utrans_write_codepoint: Assertion failed. Aborted ” error

Ellen
Splunk Employee
Splunk Employee

After a Splunk restart without any configuration changes, I can no longer issue any Splunk CLI commands such as these:

1) /home/splunk/bin/splunk search ‘Test’ -auth admin:password

2) /home/splunk/bin/splunk search ‘Test’ and then at the prompt enter in Splunk Username and Password

3) /home/splunk/bin/splunk list monitor –auth admin:password

The following error message is immediately displayed:

“/opt/splunk/p4/splunk/branches/prince/src/libzero/unicode-file-writer.c:122: utrans_write_codepoint: Assertion `(ufil->common.encoding & 0xFF) == (0x0004)' failed. Aborted”

Tags (2)
1 Solution

Ellen
Splunk Employee
Splunk Employee

It was determined this was likely due to a failed attempt to login when no disk space was available and resulted in a zero byte authorization token file in the user’s home subdirectory of “.splunk”

The workaround is to run: $SPLUNK_HOME/bin/splunk login and enter the Splunk username and password to recreate the authToken file

Filename:

authToken_<hostname>_<Splunk_management_port>     (eg. authToken_MySplunkdHost_8089)

On Unix: $HOME/.splunk/

On Windows: "%HOMEDRIVE%%HOMEPATH%.splunk\

Defect SPL-31651 was logged and targeted to be fixed in the 4.1.3 maintenance release.

View solution in original post

Ellen
Splunk Employee
Splunk Employee

It was determined this was likely due to a failed attempt to login when no disk space was available and resulted in a zero byte authorization token file in the user’s home subdirectory of “.splunk”

The workaround is to run: $SPLUNK_HOME/bin/splunk login and enter the Splunk username and password to recreate the authToken file

Filename:

authToken_<hostname>_<Splunk_management_port>     (eg. authToken_MySplunkdHost_8089)

On Unix: $HOME/.splunk/

On Windows: "%HOMEDRIVE%%HOMEPATH%.splunk\

Defect SPL-31651 was logged and targeted to be fixed in the 4.1.3 maintenance release.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...