Splunk Enterprise

Splunk UF - The file is invalid, cannot open

NoSpaces
Contributor

Hello to everyone!
I have an UF installed on a MS file server
Our Unified Communications Manager sends CDR and CMR files to this file server via SFTP
Often enough, I see error messages, as you see in the screenshot (UF cannot read the file)
The most strange thing is that all information from such files is successfully read
What is wrong with my UF settings?
Or maybe this is not UF?

props.conf

[ucm_file_cdr]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS = csv 
TIMESTAMP_FIELDS = dateTimeOrigination
BREAK_ONLY_BEFORE_DATE = False
MAX_TIMESTAMP_LOOKAHEAD = 60
initCrcLength = 1500
ANNOTATE_PUNCT = false
TRANSFORMS-no_column_headers = no_column_headers

[ucm_file_cmr]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS=csv
TIMESTAMP_FIELDS = dateTimeOrigination
BREAK_ONLY_BEFORE_DATE = False
MAX_TIMESTAMP_LOOKAHEAD = 13
initCrcLength = 1000
ANNOTATE_PUNCT = false
TRANSFORMS-no_column_headers = no_column_headers

 

transforms.conf

[no_column_headers]
REGEX = ^INTEGER\,INTEGER\,INTEGER.*$
DEST_KEY = queue
FORMAT = nullQueue

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...