Splunk Search

Why am I getting error "Configuration initialization for {Path} took longer than expected when dispatching a search"?

Explorer

The following error is displayed can't figure any solution need help.

Configuration initialization for {Path} took longer than expected when dispatching a search
1 Solution

SplunkTrust
SplunkTrust

When you create a search, it creates a "search bundle" that contains all the knowledge objects associated with that search (lookups, etc.).

{PATH} should have been populated with a file system path to the bundle.

My guess is you have bad file system permissions and need to recursively chown your splunk directory and insure the proper user is running splunk.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

When you create a search, it creates a "search bundle" that contains all the knowledge objects associated with that search (lookups, etc.).

{PATH} should have been populated with a file system path to the bundle.

My guess is you have bad file system permissions and need to recursively chown your splunk directory and insure the proper user is running splunk.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The user that the SplunkD service is running as.

Many times in linux, people start splunk as root one day and as splunk the next. Well files will then be owned by root user and the splunk user can't modify those files then.

0 Karma

Path Finder

But finally how do I solve this problem?

0 Karma

Explorer

Hi ,

Thanks for your reply

As you mentioned " Proper user is running splunk" By which user should i login inorder to avoid this error message.

0 Karma