Getting Data In

Bug: tried to check/configure STData processing but have no pending metadata.

mnamestnik
Explorer

All, having issues getting some data into Splunk. I have a system that processes literally tens of thousands of CSV files every day. I am getting the error in the subject line with a passel of the files every day, nothing consistent or different than anything else, files of the same type/content do ingest while others don't with this error... Below are my props.conf and inputs.conf from the UF where I am doing all this work, hopefully someone out there can help me. I am wondering if it's because Splunk is trying to pick it up too quickly before it has data, or proper EOF entries, etc. but have no idea how to build in a delay to ensure the data is complete before trying. It appears once Splunk has tried once, it doesn't try to ingest it again, maybe even a setting that makes Splunk try more than once would be enough to make it work? Any help appreciated.

props.conf

[csv]
force_local_processing = true
DATETIME_CONFIG = NONE
CHARSET = AUTO

inputs.conf

[default]
host = <redacted>

[monitor://D:\IngestRoot\*\*]
disabled = 0
index = <redacted>
recursive = true
whitelist = .*SplunkIngest\.csv$
crcSalt = <SOURCE>

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...