I am seeing a continuous stream of error messages on one of my indexers, such as this sample: 03-13-2012 15:28:33.861 +0000 WARN PipelineInputChannel - channel "source::C:\Program Files\SplunkUniversalForwarder/var/log/splunk/splunkd.log|host::DC-SERVER-21|SplunkUniversalForwarder/var/log/splunk/splunkd-2|remoteport::2239" ended without a done-key 03-13-2012 15:28:34.034 +0000 ERROR TcpInputProc - Failed to resurrect 954 byte message! from src=10.9.81.21:2238 03-13-2012 15:28:34.934 +0000 ERROR TcpInputProc - Failed to resurrect 1338 byte message! from src=10.9.81.21:2250 03-13-2012 15:28:36.890 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2258 03-13-2012 15:28:37.442 +0000 ERROR TcpInputProc - Failed to resurrect 1262 byte message! from src=10.9.81.21:2247 03-13-2012 15:28:37.810 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2259 03-13-2012 15:28:39.911 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2267 Any ideas on how to identify the problem? The forwarder is running on Windows. Thanks! ... View more

Is the path specified in a monitor stanza in inputs.conf case sensitive? For example, [monitor://C:\Windows\System32\dhcp] does not seem to work on servers that use the path of C:\WINDOWS\system32\dhcp . It's the same path except for capitalization of directory names. If this is correct, is there a way to make it not case sensitive? Thanks! ... View more