Getting Data In

Why is my universal forwarder reporting "INFO WatchedFile - Resetting fd to re-extract header"?

a212830
Champion

One of my servers running a universal forwarder is spitting out this message quite frequently:

02-04-2016 16:48:49.607 -0500 INFO  WatchedFile - Resetting fd to re-extract header.

What is this telling me? Each file does have a header, which we ignore via the FIELD_HEADER_REGEX parameter. Is it telling me that the header is being extracted? (These files roll over quite a bit).

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I imagine its just letting you know the file is being opened from the start again. Might be resulting from the crcSalt but I honestly don't know - just guessing.

Also worth noting that its an INFO log entry so its not necessarily telling you of a problem. Is there a larger issue you are trying to address and believe this to be a symptom of?

0 Karma

reansh
Observer

Headers from a csv files are also getting ingested while props and transforms are defined to discard the headers as per following configs:
[sourcetype]
REGEX = Username
DEST_KEY = queue
FORMAT = nullQueue

Username is my header.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...