Getting Data In

Why is the batch processor not honouring the metadata header?

Marinus
Communicator

Something's up with the batch processor. I send the following file to a sink and it doesn't set any of the metadata fields as it used to previously.

Also documented at http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically

dummy.log

***SPLUNK*** host=something source=keyboard sourcetype=text
this is an event!

Subsequent processing of props and transforms don't event happen.
The event get's indexed as if I never specified the header.

Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).

PS I noticed another post with a similar problem
http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings

0 Karma
1 Solution

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always

View solution in original post

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Splunk is excited to announce the General Availability (GA) of Federated Search for ...

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust ...

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...