Archive

header problem in splunk reading the wrong header

Path Finder

i am using perl script to pull the data from DB. The data is indexed perfectly and it's using the header that i was mentioned in the script. But after some time it's taking the one of the event as the header and it's indexing the data. what might be the problem.
here attaching the inputs and props .please help me

inputs.conf
[script:///opt/li/splunk/etc/apps/input/bin/actions.pl]
interval = 0 */1 * * *
index = _internal
sourcetype = actions
source = actions.pl
disabled = false

[batch:///opt/li/splunk/etc/apps/input/bin/actionsdata.psv*]
index = sample
sourcetype = actions
move
policy = sinkhole
disabled = false
crcSalt=

props.conf

[actions]
SHOULDLINEMERGE=false
INDEXED
EXTRACTIONS=PSV
NOBINARYCHECK=true
DATETIME_CONFIG=NONE
CHARSET=auto
disabled=false
category=sample

0 Karma
1 Solution

Path Finder

hi guys,

i found the solution that in props.conf if i use CHECKFORHEADER=TRUE the events are extracting in the correct manner.

thanx.

View solution in original post

0 Karma

Esteemed Legend

Change from batch to monitor so that the original source file is preserved (this step is not necessary if you have access to the original file through some other means) and then check the source field for the event that contains the header. Once you know the name of the offending file, go back to it and examine it. I believe you will find something in that file that is different from all the other files. There might be a blank line as the first line or some other unexpected characters or formatting. Eliminate the source of this and that will fix your problem.

0 Karma

Path Finder

hi guys,

i found the solution that in props.conf if i use CHECKFORHEADER=TRUE the events are extracting in the correct manner.

thanx.

View solution in original post

0 Karma