Why am I getting error "Configuration initialization for {Path} took longer than expected when dispatching a search"?

[himapate]

The following error is displayed can't figure any solution need help.

Configuration initialization for {Path} took longer than expected when dispatching a search

[jkat54 · Accepted solution]

When you create a search, it creates a "search bundle" that contains all the knowledge objects associated with that search (lookups, etc.).

{PATH} should have been populated with a file system path to the bundle.

My guess is you have bad file system permissions and need to recursively chown your splunk directory and insure the proper user is running splunk.

[jkat54]

The user that the SplunkD service is running as.

Many times in linux, people start splunk as root one day and as splunk the next. Well files will then be owned by root user and the splunk user can't modify those files then.

[rmanrique]

But finally how do I solve this problem?

[himapate]

Hi ,

Thanks for your reply

As you mentioned " Proper user is running splunk" By which user should i login inorder to avoid this error message.