Getting Data In

TailingProcessor - Ignoring path="/path/to/xyz" due to: Bug: tried to check/configure STData processing but have no pending metadata.

abonuccelli_spl
Splunk Employee
Splunk Employee

Splunk is having some problems importing some files. Whenever I drop the new file onto monitored directory the Splunkd log reports the following.

01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - Unable to open 'D:\mydata\myfile_out.csv'.

01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - The file 'D:\mydata\myfile_out.csv' is invalid. Reason: cannot_read

01-02-2014 09:08:07.855 +0000 INFO TailingProcessor - Ignoring file 'D:\mydata\myfile_out.csv' due to: cannot_read

01-02-2014 09:08:09.727 +0000 ERROR TailingProcessor - Ignoring path="D:\mydata\myfile_out.csv" due to: Bug: tried to check/configure STData processing but have no pending metadata.

How to solve this?

Tags (2)
1 Solution

abonuccelli_spl
Splunk Employee
Splunk Employee

set CHARSET for the related source/source type in related props.conf stanza to

CHARSET = AUTO

View solution in original post

thierryit
Path Finder

props.conf of the forwarder ?

0 Karma

abonuccelli_spl
Splunk Employee
Splunk Employee

set CHARSET for the related source/source type in related props.conf stanza to

CHARSET = AUTO

nysoitsmiket
Explorer

Thanks, I'll watch for that update.

Interesting note: Restarting splunkd caused all of the ignored log files to be indexed.

bhawkins1
Communicator

Not only did it index the ignored file, but it also caused subsequent changes to the file to be indexed. In other words, restarting splunk cleared up the bug without CHARSET = AUTO.

0 Karma

reswob4
Builder

@nysoitsmiket, restarting Splunk also worked for me.

0 Karma

abonuccelli_spl
Splunk Employee
Splunk Employee

This should go wherever the inputs are defined - input stanza then on UF or IDX.

nysoitsmiket - There is also a related bug with same error message,which required some code change which will be released through maintenance release 6.0.2, expected to be available very soon. Try that, if it won't address your problem, then get in touch with support.

0 Karma

nysoitsmiket
Explorer

This change did not work in my case. I am copying the input file from a CIFS share into a local directory for Splunk to consume it. It almost looks like the file is being accessed before it has any data in it. Is there a way to build a delay into the detection of a new file and when it gets read? After the file has been ignored I can load it with the OneShotInputHandler so there is nothing wrong with the file.

0 Karma

fisuser1
Contributor

Is this change set on the Index server or the universal forwarder?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...