After a Splunk restart without any configuration changes, I can no longer issue any Splunk CLI commands such as these:
1) /home/splunk/bin/splunk search ‘Test’ -auth admin:password
2) /home/splunk/bin/splunk search ‘Test’ and then at the prompt enter in Splunk Username and Password
3) /home/splunk/bin/splunk list monitor –auth admin:password
The following error message is immediately displayed:
“/opt/splunk/p4/splunk/branches/prince/src/libzero/unicode-file-writer.c:122: utrans_write_codepoint: Assertion `(ufil->common.encoding & 0xFF) == (0x0004)' failed. Aborted”
It was determined this was likely due to a failed attempt to login when no disk space was available and resulted in a zero byte authorization token file in the user’s home subdirectory of “.splunk”
The workaround is to run: $SPLUNK_HOME/bin/splunk login and enter the Splunk username and password to recreate the authToken file
Filename:
authToken_<hostname>_<Splunk_management_port> (eg. authToken_MySplunkdHost_8089)
On Unix: $HOME/.splunk/
On Windows: "%HOMEDRIVE%%HOMEPATH%.splunk\
Defect SPL-31651 was logged and targeted to be fixed in the 4.1.3 maintenance release.
It was determined this was likely due to a failed attempt to login when no disk space was available and resulted in a zero byte authorization token file in the user’s home subdirectory of “.splunk”
The workaround is to run: $SPLUNK_HOME/bin/splunk login and enter the Splunk username and password to recreate the authToken file
Filename:
authToken_<hostname>_<Splunk_management_port> (eg. authToken_MySplunkdHost_8089)
On Unix: $HOME/.splunk/
On Windows: "%HOMEDRIVE%%HOMEPATH%.splunk\
Defect SPL-31651 was logged and targeted to be fixed in the 4.1.3 maintenance release.