Getting Data In

Bug: tried to check/configure STData processing but have no pending metadata.

mnamestnik
Explorer

All, having issues getting some data into Splunk. I have a system that processes literally tens of thousands of CSV files every day. I am getting the error in the subject line with a passel of the files every day, nothing consistent or different than anything else, files of the same type/content do ingest while others don't with this error... Below are my props.conf and inputs.conf from the UF where I am doing all this work, hopefully someone out there can help me. I am wondering if it's because Splunk is trying to pick it up too quickly before it has data, or proper EOF entries, etc. but have no idea how to build in a delay to ensure the data is complete before trying. It appears once Splunk has tried once, it doesn't try to ingest it again, maybe even a setting that makes Splunk try more than once would be enough to make it work? Any help appreciated.

props.conf

[csv]
force_local_processing = true
DATETIME_CONFIG = NONE
CHARSET = AUTO

inputs.conf

[default]
host = <redacted>

[monitor://D:\IngestRoot\*\*]
disabled = 0
index = <redacted>
recursive = true
whitelist = .*SplunkIngest\.csv$
crcSalt = <SOURCE>

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...