All, having issues getting some data into Splunk. I have a system that processes literally tens of thousands of CSV files every day. I am getting the error in the subject line with a passel of the files every day, nothing consistent or different than anything else, files of the same type/content do ingest while others don't with this error... Below are my props.conf and inputs.conf from the UF where I am doing all this work, hopefully someone out there can help me. I am wondering if it's because Splunk is trying to pick it up too quickly before it has data, or proper EOF entries, etc. but have no idea how to build in a delay to ensure the data is complete before trying. It appears once Splunk has tried once, it doesn't try to ingest it again, maybe even a setting that makes Splunk try more than once would be enough to make it work? Any help appreciated.
props.conf
[csv]
force_local_processing = true
DATETIME_CONFIG = NONE
CHARSET = AUTO
inputs.conf
[default]
host = <redacted>
[monitor://D:\IngestRoot\*\*]
disabled = 0
index = <redacted>
recursive = true
whitelist = .*SplunkIngest\.csv$
crcSalt = <SOURCE>
