Update:
I took a chance that the very long hash in the file name was base64 encoding. It turns out it is, and the filename actually contains several hashes. The details of what gets hashed can be found in https://www.splunk.com/blog/2012/09/12/deciphering-dispatch-directory-names.html.
My particular problem is threefold:
1) we authenticate with certs, so our Splunk usernames are very verbose x.500 style distinguished names (DNs), e.g.
CN=john doe 54rtg37, OU=software division, O=mycompanyname , L=codeville, S=ma, C=US
which splunk has to hash to get a valid filename.
2) base64 encoding expands my already 73 character long DN into a 98 character hash
3) Splunk concatenates that hash into the dispatch file name TWICE (user running the search, user context its run in)
The result is a dispatch file name that's over the 255 character limit. In my case, the file name is exactly 256 characters long - so I missed by one character. The file doesn't get created, so the search fails.
I understand from a coworker that Splunk already has a trouble ticket open on this issue, but hasn't yet committed the fix to a release. Until then, I'm SOL.
Maybe I should change my name to Al Lee... B>D
... View more