Getting Data In

"INFO WatchedFile - Resetting fd to re-extract header"?

yuvasree
Explorer

I have the csv file which has the below lines.

=========================

METRIC_NAME,METRIC_UNIT,BEGIN_TIME,END_TIME,MAXVAL,MINVAL,AVERAGE

Buffer Cache Hit Ratio,% (LogRead - PhyRead)/LogRead,09/25/2022 14:59,09/25/2022 15:59,100,0,100
Memory Sorts Ratio,% MemSort/(MemSort + DiskSort),09/25/2022 14:59,09/25/2022 15:59,100,0,100
Redo Allocation Hit Ratio,% (#Redo - RedoSpaceReq)/#Redo,09/25/2022 14:59,09/25/2022 15:59,100,0,100
User Transaction Per Sec,Transactions Per Second,09/25/2022 14:59,09/25/2022 15:59,1.383,0,.528
Physical Reads Per Sec,Reads Per Second,09/25/2022 14:59,09/25/2022 15:59,1.05,0,.138
Physical Reads Per Txn,Reads Per Txn,09/25/2022 14:59,09/25/2022 15:59,2.296,0,.223

-----160 lines

I have modified the header , inputs.conf &props.conf but still the mentioned error has seen.

 

Inputs.conf:

[monitor:///u01/app/oracle/scripts/Performance_metrics/output]
disabled = false
index=brm_db
initCrcLength=2048
sourcetype = csv
crcSalt=<SOURCE>

 

Props.conf:

[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
KV_MODE = none
category = custom
HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS=_
HEADER_FIELD_DELIMITER=,
FIELD_DELIMITER=,
description = Comma-separated value format. Set header and other settings in "Delimited Settings"

Can someone help with this as i need to complete it ASAP. Stuck for almost 2 days with this. Quickly help can be appreciated.

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one reason for that could be that UF needs to read those header names again and again to send that information with events. Can you try to add FIELD_NAMES= ..... to your props.conf to avoid that?

r. Ismo

0 Karma

yuvasree
Explorer

Actually again in one server for another output same kind of error seen.

As you recommended I can't set the field names as I have 40 files under the same folder and also the common thing is all these are SQL outputs. Can someone help me with this error as this is blocking the full work .

I tried too many settings nothing helped.

@isoutamo @woodcock @gcusello

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...