I am getting error from tailreader and file is not being auto indexed

katzr — Fri, 19 Jan 2018 19:36:45 GMT

I have a .csv that was dropped in an auto index folder and I am getting this error:

-0500 ERROR TailReader - Ignoring path="X" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions conf

I did not change my process (another file was dropped here this morning and it worked fine) and this file doesn't look any different- do you know why this is happening/how to fix?

Thank you!

Re: I am getting error from tailreader and file is not being auto indexed

mayurr98 — Fri, 19 Jan 2018 20:56:45 GMT

hey
Have you configured anything that is use for extraction in props.conf?
you have to remove the extraction from your props.conf on your forwarder. Universal Forwarders cannot extract fields (they can only filter events). To extract fields with a forwarder you would need a heavy forwarder.
have a look at this answers
https://answers.splunk.com/answers/387158/bug-during-applypendingmetadata-header-processor-d.html
https://answers.splunk.com/answers/489579/error-bug-during-applypendingmetadata-header-proce.html

let me know if this helps!

topic I am getting error from tailreader and file is not being auto indexed in Getting Data In

I am getting error from tailreader and file is not being auto indexed

Re: I am getting error from tailreader and file is not being auto indexed