Getting Data In

In my Splunk developed app, everything works fine on Linux, but why is an extra line added to the beginning of all config files on Windows?

New Member

Hi everyone,

I am currently facing the following problem: In my Splunk developed APP, on Linux everything seems to be working fine. However, when I switch to Windows, I always get an extra line at the beginning of all the config files being written with the $APP_HOME$/local/ directory. This extra line always causes the app to crash with the following exception being triggered:

EXCEPTION: [File contains no section headers.]

Any ideas??

Thanks a lot in advance!

0 Karma


How are you creating your files on Linux (what editor)? Sounds like you may be having one of two problems, UTF-8 BOM issues or a line ending issue.

(BOM, or Byte Order Mark (U+FEFF), is a Unicode character "magic number" to ID info about the text stream following. In vi:

:set nobomb

In emacs:

C-x RET f

C-x RET f is the default binding for set-buffer-file-coding-system, you are changing from utf-8-with-signature to plain utf-8.

As for line endings, a different sequence of characters is used to signify an end of a line between *NIX and Windows. On Unix, it’s the LF character (\n, 0A or 10 in decimal). On Windows, it’s a sequence of two characters, CR and LF (\r + \n, 0D + 0A or 13 + 10 in decimal).

Try converting the configuration files to Windows line endings. On Windows: TYPE input_filename | MORE /P > output_filename On Linux you can use unix2dos, awk 'sub("$", "\r")' unixfile.txt > winfile.txt, or when editing the file in vi:

:set fileformat=dos

or in emacs:

M-x set-buffer-file-coding-system utf-8-dos

If it turns out to be a BOM problem, I would file a bug. Splunk on Windows should correctly handle them, since BOMs are a MS invention.

New Member

Hi Whahn,

Even we have run in to a same issue, where conf files are created with extra line in windows, can you please share the latest update or workaround you might have used to fix this if any.

However for now as a workaround, if the blank files are created in local folder manually, it works fine(by updating the data in conf file without issues - i.e issue is only while creating a new file).

if there is a fix or update , please share.


0 Karma

New Member

I am a colleague of Mostafa.

Many thanks for the response. Unfortunately none of your hints worked.
When I am in Windows I can make the app working again, when I remove the additional line and set the encoding to ANSI or UTF-8 (no-BOM) - which is actually strange, because it should to the same like your suggestions in vim/emacs.

We forgot to mention that we are using Splunk 6.2.6 and within our python scripts, we use the methods readConf() and writeConf()
but without any parameters that specify encoding.
The splunk website for developers is actually pretty confusing. At least I was not able to find out if both methods are deprecated or not, or if there is any proper replacement (I assume there is one).

0 Karma

New Member

Hi Mostafa/Whahn,

Were you able resolve this issue. kindly share the details if so.


0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...