Seeing errors of form: ERROR NewSavedSearchMgr - Error base64 decoding section...

[bohanlon_splunk]

Why am I seeing errors of this form:
09-06-2016 08:42:25.189 +0000 ERROR NewSavedSearchMgr - Error base64 decoding section of remote_myhost1.company.com_SIDNumber: myhost1.company.com

[bohanlon_splunk]

Cause:
We do remote search.log fetching as the very last thing in a search process. This means it is done after ALL indexers have returned all their results. This means that one indexer can finish its search 20 minutes into the SH's search, but another indexer can finish 1 hour later. This means that we will be seeing the early finishing indexers reaping their search artifacts way before we fetch them causing the base64 errors. This is purely cosmetic. If the customer wants to stop seeing this error, they can update their limits.conf.

Workaround = Change limits.conf
Limits.conf
[search]
fetch_remote_search_log = disabled

Splunk references:
See SPL-111099 and SPL-128151.

[effem]

Wouldnt it be better to hold the logfiles as long as the Searchhead has not all results? This way we are missing the remote-Search.log from the indexer everytime the indexers have a high difference in finishing their Search.