Sorry for bringing this up again, but the other questions haven't been answered yet in a way that would help us.
I'm getting said error, but only when trying to upload the whole log file. I tried just uploading a single line, that works fine.
We're currently using Splunk 6.5.0 on Ubuntu (16, I think) and the log files are custom log files created by NGINX, but nothing special, here's an anonymized sample line:
2016-11-14T16:35:28+01:00 xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx 443 GET /xxx/xxx/xxx.xxx xxx=xxx&xxx=xxx&xxx=xxx&xxx=xxx&xxx=xxx 200 1267 0.419 "Apache-HttpClient/4.5.1 (Java/1.8.0_92)"
I already checked the file, if there's any lines with more or less entries, that might result in a null value, but they all had the 12 entries we are expecting.
Any more ideas on what the problem could be? Is there maybe a validation tool that we can run to check, if the log file is OK to import? The check I ran was just a simple CSV parser that checked line by line for the number of entries, so maybe that missed something.
Thanks a lot!
