Archive

SPECIFIC sourcetypes are not forwarded while everything is forwarded.Splunk Forwarder is showing that log file is emptyline as a WARN message in Splunkd.log as Follow :

New Member

Splunk Forwarder is showing that log file is emptyline as a WARN message in Splunkd.log as Follow :

01-23-2018 20:50:06.116 +0000 WARN CsvLineBreaker - CSV StreamId: 18364207351549900662 has empty line. - data_source="/data/credit/file.tsv", data
_host="Sciloapi", data_sourcetype="ticket_data"

01-30-2018 10:20:04.637 +0000 WARN CsvLineBreaker - CSV StreamId: 7621279048930603185 has empty line. - data_source="/data01/DataExtractor/Data/Ticket_Log/Ticket_Log_20180130.tsv", data_h
ost="Sciloapi", data_sourcetype="ticketlog_data"

But the Actual File is not empty it has Data.
I checked everything the portnumber,metricslog,splunkd
everything is good.
Except those two sourcetypes ,the remaining data is getting forwarded.
The only problem is those TWO specific sourcetypes r not getting forwarded from last 7 days.

what would be the problem??

Please help me !

Tags (1)
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!