topic Re: header problem in splunk reading the wrong header in Splunk Search

header problem in splunk reading the wrong header

lavanyaanne — Tue, 29 Sep 2020 10:26:44 GMT

i am using perl script to pull the data from DB. The data is indexed perfectly and it's using the header that i was mentioned in the script. But after some time it's taking the one of the event as the header and it's indexing the data. what might be the problem.
here attaching the inputs and props .please help me

inputs.conf
[script:///opt/li/splunk/etc/apps/input/bin/actions.pl]
interval = 0 */1 * * *
index = _internal
sourcetype = actions
source = actions.pl
disabled = false

[batch:///opt/li/splunk/etc/apps/input/bin/actions_data.psv*]
index = sample
sourcetype = actions
move_policy = sinkhole
disabled = false
crcSalt=

props.conf

[actions]
SHOULD_LINEMERGE=false
INDEXED_EXTRACTIONS=PSV
NO_BINARY_CHECK=true
DATETIME_CONFIG=NONE
CHARSET=auto
disabled=false
category=sample

Re: header problem in splunk reading the wrong header

lavanyaanne — Tue, 29 Sep 2020 10:29:34 GMT

hi guys,

i found the solution that in props.conf if i use CHECK_FOR_HEADER=TRUE the events are extracting in the correct manner.

thanx.

Re: header problem in splunk reading the wrong header

woodcock — Mon, 01 Aug 2016 13:56:23 GMT

Change from batch to monitor so that the original source file is preserved (this step is not necessary if you have access to the original file through some other means) and then check the source field for the event that contains the header. Once you know the name of the offending file, go back to it and examine it. I believe you will find something in that file that is different from all the other files. There might be a blank line as the first line or some other unexpected characters or formatting. Eliminate the source of this and that will fix your problem.