Splunk Search

I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"?

mikehsieh
Engager

I am getting ERROR HttpListener when I search and do not get any data - this error is in splunk server 6.2.3

06-19-2015 13:54:00.722 -0400 ERROR HttpListener - Exception while processing request from 11.48.178.51 for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+host%3D%2211.48.222.101%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1434736433926: Connection closed by peer
06-19-2015 13:54:00.722 -0400 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+host%3D%2211.48.222.101%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1434736433926 sent a 0 byte response after earlier claiming a Content-Length of 641!
Tags (1)

despachoSTD
Explorer

Chech if you have disabled (or even deleted) the default data input pointing at:

$SPLUNK_HOME$/var/spool/dbmon/*.dbmonevt"

or have any problem in creating files in that location.

It turns out that the dbx app writes the results in that kind of files in that dir, and later Splunk indexes (and deletes) that files to read the results.

0 Karma

despachoSTD
Explorer

Beware that if you simply start the data input with all the files in the dir, the system will perform all the pending indexings, potentially causing licensing issues and/or repetitions.

If you want to start clean, stop splunk, delete all the files in the dir, start splunk and enable the data input again.

0 Karma

klsio
Explorer

I have same error..

0 Karma

gsawyer1
Engager

I had a similar error and was unable to login to my Splunk instance via web. I cleared the cache and all history etc from the browser, restarted the computer, and lo and behold, problem disappeared. But, my errors were related to the display of webfonts when I tried to view an XML dashboard's source in plaintext, and resulted in Winsock error 10045 (connection reset). They ended with:
sent a 0 byte response after earlier claiming a Content-Length of xxxx!

So maybe that will help you or someone else....

0 Karma

thashmi
Splunk Employee
Splunk Employee

If you could brief about your webui not loading issue and how did you resolve it.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Look at the dates 🙂

You're responding to an almost 8-years old thread regarding a 6.x Splunk version.

I wouldn't expect a reasonable response here.

0 Karma

mekamundia
Explorer

I am receiving this error every day too

0 Karma

karthikannan
New Member

Does anybody know the solution for this issue. I'm facing the same....

0 Karma

l-mss-n3
New Member

I have been working with the same problem, Did you found any solution?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...