Splunk is having some problems importing some files. Whenever I drop the new file onto monitored directory the Splunkd log reports the following.
01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - Unable to open 'D:\mydata\myfile_out.csv'.
01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - The file 'D:\mydata\myfile_out.csv' is invalid. Reason: cannot_read
01-02-2014 09:08:07.855 +0000 INFO TailingProcessor - Ignoring file 'D:\mydata\myfile_out.csv' due to: cannot_read
01-02-2014 09:08:09.727 +0000 ERROR TailingProcessor - Ignoring path="D:\mydata\myfile_out.csv" due to: Bug: tried to check/configure STData processing but have no pending metadata.
How to solve this?
Not only did it index the ignored file, but it also caused subsequent changes to the file to be indexed. In other words, restarting splunk cleared up the bug without
CHARSET = AUTO.
This should go wherever the inputs are defined - input stanza then on UF or IDX.
nysoitsmiket - There is also a related bug with same error message,which required some code change which will be released through maintenance release 6.0.2, expected to be available very soon. Try that, if it won't address your problem, then get in touch with support.
This change did not work in my case. I am copying the input file from a CIFS share into a local directory for Splunk to consume it. It almost looks like the file is being accessed before it has any data in it. Is there a way to build a delay into the detection of a new file and when it gets read? After the file has been ignored I can load it with the OneShotInputHandler so there is nothing wrong with the file.