Splunk Forwarder is showing that log file is emptyline as a WARN message in Splunkd.log as Follow :
01-23-2018 20:50:06.116 +0000 WARN CsvLineBreaker - CSV StreamId: 18364207351549900662 has empty line. - data_source="/data/credit/file.tsv", data
_host="Sciloapi", data_sourcetype="ticket_data"
01-30-2018 10:20:04.637 +0000 WARN CsvLineBreaker - CSV StreamId: 7621279048930603185 has empty line. - data_source="/data01/DataExtractor/Data/Ticket_Log/Ticket_Log_20180130.tsv", data_h
ost="Sciloapi", data_sourcetype="ticketlog_data"
But the Actual File is not empty it has Data.
I checked everything the portnumber,metricslog,splunkd
everything is good.
Except those two sourcetypes ,the remaining data is getting forwarded.
The only problem is those TWO specific sourcetypes r not getting forwarded from last 7 days.
what would be the problem??
Please help me !