Skip to main content

What does this message indicate on the Splunk TCP source:

message:
Failed to parse s2s payload
{}

error:
α
message:
Cannot advance offset 2023514992 past end of event 74
α
stack:
Error: Cannot advance offset 2023514992 past end of event 74
at p.advance (/opt/cribl/bin/cribl.js:14:12271888)
at h._readEvents (/opt/cribl/bin/cribl.js:14:12274323)
at h._transform (/opt/cribl/bin/cribl.js:14:12275791)
at h.Transform._read (_stream_transform.js:205:10)
at h.Transform._write (_stream_transform.js:193:12)
at writeOrBuffer (_stream_writable.js:352:12)
at h.Writable.write (_stream_writable.js:303:10)
at Socket.ondata (_stream_readable.js:719:22)
at Socket.emit (events.js:315:20)
at Socket.EventEmitter.emit (domain.js:486:12)Show less

Hi @fshelton79, I would encourage you to open a support case so that we can troubleshoot further.

Working with Cribl Support | Cribl Docs

If you run into issues with Cribl Stream, please first check our Known Issues page for recommended resolutions or workarounds. For questions not addressed there, this page outlines how to engage with the Cribl Support staff to resolve problems...

Reply


Terms & ConditionsCookie settings