Getting Data In

SPECIFIC sourcetypes are not forwarded while everything is forwarded.Splunk Forwarder is showing that log file is emptyline as a WARN message in Splunkd.log as Follow :

akhil36109
New Member

Splunk Forwarder is showing that log file is emptyline as a WARN message in Splunkd.log as Follow :

01-23-2018 20:50:06.116 +0000 WARN CsvLineBreaker - CSV StreamId: 18364207351549900662 has empty line. - data_source="/data/credit/file.tsv", data
_host="Sciloapi", data_sourcetype="ticket_data"

01-30-2018 10:20:04.637 +0000 WARN CsvLineBreaker - CSV StreamId: 7621279048930603185 has empty line. - data_source="/data01/DataExtractor/Data/Ticket_Log/Ticket_Log_20180130.tsv", data_h
ost="Sciloapi", data_sourcetype="ticketlog_data"

But the Actual File is not empty it has Data.
I checked everything the portnumber,metricslog,splunkd
everything is good.
Except those two sourcetypes ,the remaining data is getting forwarded.
The only problem is those TWO specific sourcetypes r not getting forwarded from last 7 days.

what would be the problem??

Please help me !

Tags (1)
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...