0400 ERROR DispatchProcess - String not found in literals.conf: DISPATCHCOMM:FAILED_TO_START_PROCESS
I need help finding out what this is and how to fix it.
Why is the dispatch process not working? What is dispatchcomm?
What do you use instead of literals.conf?
@kkovanis - Just make sure you have not made any changes to Splunk's internal configuration file or added any local literals.conf file.
Did you recently upgrade? literals.conf is deprecated. You should use messages.conf instead.
If you did not upgrade, make sure that literals.conf is owned by splunk:splunk and has appropriate read/write access ,and also that literals.conf contains valid stanzas and string definitions.
The dispatch process is what returns search results from your indexers to your search head(s).