Getting Data In

Why is the batch processor not honouring the metadata header?

Marinus
Communicator

Something's up with the batch processor. I send the following file to a sink and it doesn't set any of the metadata fields as it used to previously.

Also documented at http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically

dummy.log

***SPLUNK*** host=something source=keyboard sourcetype=text
this is an event!

Subsequent processing of props and transforms don't event happen.
The event get's indexed as if I never specified the header.

Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).

PS I noticed another post with a similar problem
http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings

0 Karma
1 Solution

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always

View solution in original post

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...