Getting Data In

TailingProcessor - Ignoring path="/path/to/xyz" due to: Bug: tried to check/configure STData processing but have no pending metadata.

abonuccelli_spl
Splunk Employee
Splunk Employee

Splunk is having some problems importing some files. Whenever I drop the new file onto monitored directory the Splunkd log reports the following.

01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - Unable to open 'D:\mydata\myfile_out.csv'.

01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - The file 'D:\mydata\myfile_out.csv' is invalid. Reason: cannot_read

01-02-2014 09:08:07.855 +0000 INFO TailingProcessor - Ignoring file 'D:\mydata\myfile_out.csv' due to: cannot_read

01-02-2014 09:08:09.727 +0000 ERROR TailingProcessor - Ignoring path="D:\mydata\myfile_out.csv" due to: Bug: tried to check/configure STData processing but have no pending metadata.

How to solve this?

Tags (2)
1 Solution

abonuccelli_spl
Splunk Employee
Splunk Employee

set CHARSET for the related source/source type in related props.conf stanza to

CHARSET = AUTO

View solution in original post

thierryit
Path Finder

props.conf of the forwarder ?

0 Karma

abonuccelli_spl
Splunk Employee
Splunk Employee

set CHARSET for the related source/source type in related props.conf stanza to

CHARSET = AUTO

nysoitsmiket
Explorer

Thanks, I'll watch for that update.

Interesting note: Restarting splunkd caused all of the ignored log files to be indexed.

bhawkins1
Communicator

Not only did it index the ignored file, but it also caused subsequent changes to the file to be indexed. In other words, restarting splunk cleared up the bug without CHARSET = AUTO.

0 Karma

reswob4
Builder

@nysoitsmiket, restarting Splunk also worked for me.

0 Karma

abonuccelli_spl
Splunk Employee
Splunk Employee

This should go wherever the inputs are defined - input stanza then on UF or IDX.

nysoitsmiket - There is also a related bug with same error message,which required some code change which will be released through maintenance release 6.0.2, expected to be available very soon. Try that, if it won't address your problem, then get in touch with support.

0 Karma

nysoitsmiket
Explorer

This change did not work in my case. I am copying the input file from a CIFS share into a local directory for Splunk to consume it. It almost looks like the file is being accessed before it has any data in it. Is there a way to build a delay into the detection of a new file and when it gets read? After the file has been ignored I can load it with the OneShotInputHandler so there is nothing wrong with the file.

0 Karma

fisuser1
Contributor

Is this change set on the Index server or the universal forwarder?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...