https://community.splunk.com/t5/Getting-Data-In/Why-is-the-batch-processor-not-honouring-the-metadata-header/m-p/47399#M8998 <P>Something's up with the batch processor. I send the following file to a sink and it doesn't set <EM>any</EM> of the metadata fields as it used to previously.</P> <P>Also documented at <A href="http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically">http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically</A></P> <P>dummy.log</P> <PRE><CODE>***SPLUNK*** host=something source=keyboard sourcetype=text this is an event! </CODE></PRE> <P>Subsequent processing of props and transforms don't event happen.<BR /> The event get's indexed as if I never specified the header.</P> <P>Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).</P> <P>PS I noticed another post with a similar problem<BR /> <A href="http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings">http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings</A></P> Fri, 22 Jul 2011 21:07:58 GMT Marinus 2011-07-22T21:07:58Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-batch-processor-not-honouring-the-metadata-header/m-p/47399#M8998 <P>Something's up with the batch processor. I send the following file to a sink and it doesn't set <EM>any</EM> of the metadata fields as it used to previously.</P> <P>Also documented at <A href="http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically">http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically</A></P> <P>dummy.log</P> <PRE><CODE>***SPLUNK*** host=something source=keyboard sourcetype=text this is an event! </CODE></PRE> <P>Subsequent processing of props and transforms don't event happen.<BR /> The event get's indexed as if I never specified the header.</P> <P>Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).</P> <P>PS I noticed another post with a similar problem<BR /> <A href="http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings">http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings</A></P> Fri, 22 Jul 2011 21:07:58 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-batch-processor-not-honouring-the-metadata-header/m-p/47399#M8998 Marinus 2011-07-22T21:07:58Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-batch-processor-not-honouring-the-metadata-header/m-p/47400#M8999 <P>Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.</P> <PRE><CODE>[source::/tmp/splunk/var/spool/splunk] HEADER_MODE = always </CODE></PRE> Tue, 02 Aug 2011 18:35:40 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-batch-processor-not-honouring-the-metadata-header/m-p/47400#M8999 Marinus 2011-08-02T18:35:40Z