Hello all,
Today I've received strange warning when trying to use the manual upload wizard to upload a csv file. I have had no previous problems with the format, the sourcetype is set properly and has been working, and the file that I'm trying to index is just like any other. During the wizard no errors are given and it completes with the usual "Start Searching" button. When I click it, though, no results are returned, and nothing gets indexed. When looking through the _internal index I find the following entry:
03-18-2019 17:27:07.456 +0000 WARN CsvLineBreaker - CSV StreamId: 0 has empty line. - data_source="import_file.csv", data_host="hostname", data_sourcetype="import_file_sourcetype"
What does this message mean, and how can I fix it so that I can index files again? I am using Splunk Enterprise 7.1.4.
Thank you and best regards,
Andrew
Edit: This issue affected the indexing of any file, regardless of format, sourcetype, app context, and target index. After restarting backend using the ./splunk restart command, all the files that previously threw the warnings were suddenly indexed. I have no idea why it did this. I also noticed that during restart the splunkd process took ages to restart, which is unusual. Look how many dots:
Shutting down. Please wait, as this may take a few minutes.
....................................................................................................................... [ OK ]
Any ideas on what was causing this?
