To import csv files, do we need a heavy forwarder or can we just use a universal forwarder?

[sreis]

Hi,

To import csv files do we need a heavy forwarder or can we just use a universal forwarder? I tried  a universal forwarder(with no Transforms.conf or props.conf) on one machine and work and now i tried in another machine and doesnt work( error:Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.). I´m new in splunk can anyone help?

Thanks in advance.

[richgalloway]

The number of differences between the two machines makes troubleshooting challenging.  Let's start by trying to ingest the same file on both. (BTW, applic.csv is not a CSV file so it will need custom props.)  If it still doesn't work then use the same version of the UF on both machines.

[sreis]

Hi,

Why you say is not csv? if try to open with excel for example the fields are separeted.

If i have to user props i need a Heavy Forwarder?

Thanks.

[richgalloway]

It's not a CSV because the Values are not Separated by Commas.  Excel can separate cells many ways so try opening the file with Notepad++.

You can continue to use a UF with custom props, just put the props on the indexer(s).

[richgalloway]

Yes, you can ingest CSV files using a universal forwarder.

Please say more about "it doesn't work" and tell us the difference(s) between the two machines.

[sreis]

Hi,

Thanks for the reply.

One machine as win2019 Datacenter with UF 8.0.2, the other that doesn t work as UF 8.2.3 and Windows 2016 Server. 

I just use Win2019 to test , create a file:

[monitor://C:\Program Files\SplunkUniversalForwarder\teste3.csv]
index = idx
sourcetype = csv
disabled = 0

file teste3.csv:

name,user,
john,xpo1
peter,xpo2

win2019:

[monitor://C:\Program Files\SplunkUniversalForwarder\applic.csv]
index = idx
sourcetype = csv
disabled = 0

file applic.csv(with just the header, file is given by an application)

Type Short Name      Date Number   Average Daily 

Get  the error: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

Thanks in advance.