I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

[mikehsieh]

I am getting ERROR HttpListener when I search and do not get any data - this error is in splunk server 6.2.3

06-19-2015 13:54:00.722 -0400 ERROR HttpListener - Exception while processing request from 11.48.178.51 for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+host%3D%2211.48.222.101%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1434736433926: Connection closed by peer
06-19-2015 13:54:00.722 -0400 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+host%3D%2211.48.222.101%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1434736433926 sent a 0 byte response after earlier claiming a Content-Length of 641!

[despachoSTD]

Chech if you have disabled (or even deleted) the default data input pointing at:

$SPLUNK_HOME$/var/spool/dbmon/*.dbmonevt"

or have any problem in creating files in that location.

It turns out that the dbx app writes the results in that kind of files in that dir, and later Splunk indexes (and deletes) that files to read the results.

[despachoSTD]

Beware that if you simply start the data input with all the files in the dir, the system will perform all the pending indexings, potentially causing licensing issues and/or repetitions.

If you want to start clean, stop splunk, delete all the files in the dir, start splunk and enable the data input again.

[klsio]

I have same error..

[gsawyer1]

I had a similar error and was unable to login to my Splunk instance via web. I cleared the cache and all history etc from the browser, restarted the computer, and lo and behold, problem disappeared. But, my errors were related to the display of webfonts when I tried to view an XML dashboard's source in plaintext, and resulted in Winsock error 10045 (connection reset). They ended with:
sent a 0 byte response after earlier claiming a Content-Length of xxxx!

So maybe that will help you or someone else....

[thashmi]

If you could brief about your webui not loading issue and how did you resolve it.

[PickleRick]

Look at the dates 🙂

You're responding to an almost 8-years old thread regarding a 6.x Splunk version.

I wouldn't expect a reasonable response here.

[mekamundia]

I am receiving this error every day too

[karthikannan]

Does anybody know the solution for this issue. I'm facing the same....

[l-mss-n3]

I have been working with the same problem, Did you found any solution?