We started getting errors like this:
04-11-2014 11:49:13.121 +1000 ERROR TailingProcessor - Ignoring path="/xxx/bro/logs/current/http.log" due to: Bug: tried to check/configure STData processing but have no pending metadata.
There have been no configuration changes and this is happening on multiple files, multiple times per day.
This is critical data to us. We are on 6.1.1 and upgraded to 6.1.3 without any improvement.
This is a known issue (SPL-88387), the fix will be shipped on 6.1.4.
Workaround:
Go to $SPLUNK_HOME/etc/system/local and open limits.conf to edit.
Add min_batch_size_bytes (default 20MB)in limits.conf. Set it to higher like 100MB.
min_batch_size_bytes = 104857600
Restart Splunkd
This is a known issue (SPL-88387), the fix will be shipped on 6.1.4.
Workaround:
Go to $SPLUNK_HOME/etc/system/local and open limits.conf to edit.
Add min_batch_size_bytes (default 20MB)in limits.conf. Set it to higher like 100MB.
min_batch_size_bytes = 104857600
Restart Splunkd