Getting Data In

Why is the batch processor not honouring the metadata header?

Marinus
Communicator

Something's up with the batch processor. I send the following file to a sink and it doesn't set any of the metadata fields as it used to previously.

Also documented at http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically

dummy.log

***SPLUNK*** host=something source=keyboard sourcetype=text
this is an event!

Subsequent processing of props and transforms don't event happen.
The event get's indexed as if I never specified the header.

Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).

PS I noticed another post with a similar problem
http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings

0 Karma
1 Solution

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always

View solution in original post

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always
Get Updates on the Splunk Community!

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...