Getting Data In

Why is the batch processor not honouring the metadata header?

Marinus
Communicator

Something's up with the batch processor. I send the following file to a sink and it doesn't set any of the metadata fields as it used to previously.

Also documented at http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically

dummy.log

***SPLUNK*** host=something source=keyboard sourcetype=text
this is an event!

Subsequent processing of props and transforms don't event happen.
The event get's indexed as if I never specified the header.

Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).

PS I noticed another post with a similar problem
http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings

0 Karma
1 Solution

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always

View solution in original post

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

How to find the worst searches in your Splunk environment and how to fix them

Everyone knows Splunk is a powerful platform for running searches and doing data analytics. Your ...

Share Your Feedback: On Admin Config Service (ACS)!

Help Us Build a Better Admin Config Service Experience (ACS)   We Want Your Feedback on Admin Config Service ...