topic Re: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs in Splunk Search

Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

sandipan11 — Wed, 30 Mar 2016 06:18:57 GMT

I am getting "Bug during applyPendingMetadata, header processor does not own the indexed extractions confs" so every file I am trying to ingest is ignoring. I am using Universal Forwarder to ingest data.

03-29-2016 22:22:27.818 -0700 ERROR TailingProcessor - Ignoring path="/opt/apps/splunk_data/uf2/data/bandy.txt" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

Can any one have solution for this?

Re: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

hmatthews_splun — Tue, 19 Jul 2016 07:12:20 GMT

I realise this question is a few months old but hopefully the following will help!

Check your props.conf on the universal forwarder - it could be caused by INDEXED_EXCTRACTIONS=<x>. I had the same recently and narrowed it down to INDEXED_EXCTRACTIONS=<x>.

You'll need the configuration on the indexers, but not on the universal forwarder.

Re: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

Paolo_Prigione — Tue, 19 Jul 2016 10:43:12 GMT

INDEXED_EXTRACTIONS are an exception in that the parsing/field extraction is performed on the UF instead of the HWF/IDX.

Re: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

abhinav_maxonic — Mon, 16 Jan 2017 06:55:36 GMT

I am also getting this error for my csv files. Splunk is not indexing some of csv files. All for them are 117KB in size. I am creating the CSV on linux using command -

ssh admin@machine1 "some command" > /opt/script_output_data/folder1/folder2/file_name_`date +\%m\%d\%Y_\%H_\%M_\%S`.csv

Error : 01-15-2017 21:40:22.148 -0800 ERROR TailReader - Ignoring path="/opt/script_output_data/folder1/folder2/file_name_01152017_21_40_18.csv" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

I have my props.conf on indexer as well as my forwarder.