Splunk Enterprise

Splunk UF - The file is invalid, cannot open

NoSpaces
Contributor

Hello to everyone!
I have an UF installed on a MS file server
Our Unified Communications Manager sends CDR and CMR files to this file server via SFTP
Often enough, I see error messages, as you see in the screenshot (UF cannot read the file)
The most strange thing is that all information from such files is successfully read
What is wrong with my UF settings?
Or maybe this is not UF?

props.conf

[ucm_file_cdr]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS = csv 
TIMESTAMP_FIELDS = dateTimeOrigination
BREAK_ONLY_BEFORE_DATE = False
MAX_TIMESTAMP_LOOKAHEAD = 60
initCrcLength = 1500
ANNOTATE_PUNCT = false
TRANSFORMS-no_column_headers = no_column_headers

[ucm_file_cmr]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS=csv
TIMESTAMP_FIELDS = dateTimeOrigination
BREAK_ONLY_BEFORE_DATE = False
MAX_TIMESTAMP_LOOKAHEAD = 13
initCrcLength = 1000
ANNOTATE_PUNCT = false
TRANSFORMS-no_column_headers = no_column_headers

 

transforms.conf

[no_column_headers]
REGEX = ^INTEGER\,INTEGER\,INTEGER.*$
DEST_KEY = queue
FORMAT = nullQueue

 

Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...