TailingProcessor - Ignoring path="/path/to/xyz" due to: Bug: tried to check/configure STData processing but have no pending metadata.

[abonuccelli_spl]

Splunk is having some problems importing some files. Whenever I drop the new file onto monitored directory the Splunkd log reports the following.

01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - Unable to open 'D:\mydata\myfile_out.csv'.

01-02-2014 09:08:07.855 +0000 WARN FileClassifierManager - The file 'D:\mydata\myfile_out.csv' is invalid. Reason: cannot_read

01-02-2014 09:08:07.855 +0000 INFO TailingProcessor - Ignoring file 'D:\mydata\myfile_out.csv' due to: cannot_read

01-02-2014 09:08:09.727 +0000 ERROR TailingProcessor - Ignoring path="D:\mydata\myfile_out.csv" due to: Bug: tried to check/configure STData processing but have no pending metadata.

How to solve this?

[thierryit]

props.conf of the forwarder ?

[abonuccelli_spl · Accepted solution]

set CHARSET for the related source/source type in related props.conf stanza to

CHARSET = AUTO

[nysoitsmiket]

Thanks, I'll watch for that update.

Interesting note: Restarting splunkd caused all of the ignored log files to be indexed.

[bhawkins1]

Not only did it index the ignored file, but it also caused subsequent changes to the file to be indexed. In other words, restarting splunk cleared up the bug without CHARSET = AUTO.

[reswob4]

@nysoitsmiket, restarting Splunk also worked for me.

[abonuccelli_spl]

This should go wherever the inputs are defined - input stanza then on UF or IDX.

nysoitsmiket - There is also a related bug with same error message,which required some code change which will be released through maintenance release 6.0.2, expected to be available very soon. Try that, if it won't address your problem, then get in touch with support.

[nysoitsmiket]

This change did not work in my case. I am copying the input file from a CIFS share into a local directory for Splunk to consume it. It almost looks like the file is being accessed before it has any data in it. Is there a way to build a delay into the detection of a new file and when it gets read? After the file has been ignored I can load it with the OneShotInputHandler so there is nothing wrong with the file.

[fisuser1]

Is this change set on the Index server or the universal forwarder?