topic Re: is CHECK_FOR_HEADER setting is deprecated ? in Getting Data In

is CHECK_FOR_HEADER setting is deprecated ?

chvenu17 — Wed, 30 Sep 2020 01:06:20 GMT

getting below errors for continuously in splunkd.log. Is CHECK_FOR_HEADER setting is deprecated in splunk forwarder version 6.5.0?

The CHECK_FOR_HEADER setting is deprecated - INDEXED_EXTRACTIONS should be used instead for file
Detected INDEXED_EXTRACTIONS setting - disabling deprecated CHECK_FOR_HEADER setting for file

My props.conf contains both CHECK_FOR_HEADER and INDEXED_EXTRACTIONS
INDEXED_EXTRACTIONS=CSV
CHECK_FOR_HEADER = true

Re: is CHECK_FOR_HEADER setting is deprecated ?

sanjum — Fri, 19 Feb 2021 15:58:46 GMT

any resolution for that? I am seeing same errors.

Re: is CHECK_FOR_HEADER setting is deprecated ?

chvenu17 — Wed, 18 Aug 2021 03:45:17 GMT

i did not find any solution, No one replied from splunk support either

Re: is CHECK_FOR_HEADER setting is deprecated ?

scelikok — Wed, 18 Aug 2021 04:35:23 GMT

This setting is deprecated. You can see documentation at https://docs.splunk.com/Documentation/Splunk/8.2.1/Admin/Configurationparametersandthedatapipeline

You can test by removing to see if INDEXED_EXTRACTIONS is enough.