Getting Data In

Why is the batch processor not honouring the metadata header?

Marinus
Communicator

Something's up with the batch processor. I send the following file to a sink and it doesn't set any of the metadata fields as it used to previously.

Also documented at http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically

dummy.log

***SPLUNK*** host=something source=keyboard sourcetype=text
this is an event!

Subsequent processing of props and transforms don't event happen.
The event get's indexed as if I never specified the header.

Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).

PS I noticed another post with a similar problem
http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings

0 Karma
1 Solution

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always

View solution in original post

Marinus
Communicator

Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.

[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...