Getting Data In

SPECIFIC sourcetypes are not forwarded while everything is forwarded.Splunk Forwarder is showing that log file is emptyline as a WARN message in Splunkd.log as Follow :

akhil36109
New Member

Splunk Forwarder is showing that log file is emptyline as a WARN message in Splunkd.log as Follow :

01-23-2018 20:50:06.116 +0000 WARN CsvLineBreaker - CSV StreamId: 18364207351549900662 has empty line. - data_source="/data/credit/file.tsv", data
_host="Sciloapi", data_sourcetype="ticket_data"

01-30-2018 10:20:04.637 +0000 WARN CsvLineBreaker - CSV StreamId: 7621279048930603185 has empty line. - data_source="/data01/DataExtractor/Data/Ticket_Log/Ticket_Log_20180130.tsv", data_h
ost="Sciloapi", data_sourcetype="ticketlog_data"

But the Actual File is not empty it has Data.
I checked everything the portnumber,metricslog,splunkd
everything is good.
Except those two sourcetypes ,the remaining data is getting forwarded.
The only problem is those TWO specific sourcetypes r not getting forwarded from last 7 days.

what would be the problem??

Please help me !

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...

Federated Search for CloudWatch Unified Data Store Is Generally Available

As organizations modernize their cloud environments, AWS workloads generate more security, operational, and ...