topic Re: ERROR ArchiveProcessor with zip files in Getting Data In

ERROR ArchiveProcessor with zip files

johnsonlui — Thu, 17 Apr 2014 06:22:00 GMT

Hello all,

We have met this error when we try to indexing the archive files into Indexer

04-17-2014 14:01:02.292 +0800 ERROR ArchiveProcessor - Archive with path="/home/splunk/data/bom/moc/CT_STATISTIC_20140417140001.csv.zip" is being skipped since FileContentException error encountered during ArchiveCrcChecker processing. Exception details="Ran out of data while looking for end of header"

May anyone help us on that?

Thanks,
Johnson

Re: ERROR ArchiveProcessor with zip files

woodcock — Thu, 29 May 2014 17:13:58 GMT

I am having the same problem and a I did figure out that if I modify the inputs.conf file to handle *.csv instead of *.csv.gz and then I gunzip the files, everything works. This means it is a problem with the gunzip process that Splunk is using on the forwarder. I will post a followup if I figure out what is really wrong and get it working but at least this might provide a workaround for you in the meantime.

Re: ERROR ArchiveProcessor with zip files

ohoppe — Tue, 17 Feb 2015 12:17:34 GMT

Have you been able to fix the described issue? I am currently facing the same, but it is not an option to extract the files as they are produced directly as gz due to lack of disk space.

Thanks
Oliver

Re: ERROR ArchiveProcessor with zip files

woodcock — Thu, 17 Dec 2015 21:52:50 GMT

I would try a moderately high number (100?) for time_before_close to make sure that the file is done being created (zipped) before you start to gunzip it:

time_before_close = <integer>
* Modtime delta required before Splunk can close a file on EOF.
* Tells the system not to close files that have been updated in past <integer> seconds.
* Defaults to 3.