topic Re: Not able to upload a file to splunk getting oneshotwriter error in Getting Data In

Not able to upload a file to splunk, getting oneshotwriter error?

Harish — Thu, 03 Nov 2022 15:12:49 GMT

Hi Team,

I am not able to upload a local log file to my local Splunk getting below error in splunkd.log

OneShotWriter failed to insert data to parsingQueue. Timed out in 5000 milliseconds.

can someone please help me with this.

Thanks

Re: Not able to upload a file to splunk getting oneshotwriter error

gcusello — Thu, 03 Nov 2022 12:02:04 GMT

Hi @Harish,

are you speaking of upload using GUI or input?

if using GUI probably your file is large or there's a slow connection (or both!) and the connection timeouted.

if using input, could you share your input?

Ciao.

Giuseppe

Re: Not able to upload a file to splunk getting oneshotwriter error

Harish — Thu, 03 Nov 2022 12:28:46 GMT

I have tried uploading the file in two ways

1. GUI : In Splunk web UI, I have selected Add Data -> File Upload -> Browse -> File [Not working got the above mentioned error in log]

2. Command : try to upload using below commands
1. ./splunk add oneshort <file-path> -index <index name> [No luck here as well]

2. Added file to splunk spool folder and tried below command
./splunk spool <file-path> -index <index-name> [No luck either]

Re: Not able to upload a file to splunk getting oneshotwriter error

Harish — Thu, 03 Nov 2022 12:32:03 GMT

And getting this error message continuously in logs

Missing or malformed messages.conf stanza for TCPOUT:FORWARDING_BLOCKED___default-autolb-group_CSLTP-069_10

Thanks