Splunk Search

Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

sandipan11
Path Finder

I am getting "Bug during applyPendingMetadata, header processor does not own the indexed extractions confs" so every file I am trying to ingest is ignoring. I am using Universal Forwarder to ingest data.

03-29-2016 22:22:27.818 -0700 ERROR TailingProcessor - Ignoring path="/opt/apps/splunk_data/uf2/data/bandy.txt" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

Can any one have solution for this?

abhinav_maxonic
Path Finder

I am also getting this error for my csv files. Splunk is not indexing some of csv files. All for them are 117KB in size. I am creating the CSV on linux using command -

ssh admin@machine1 "some command" > /opt/script_output_data/folder1/folder2/file_name_`date +\%m\%d\%Y_\%H_\%M_\%S`.csv

Error : 01-15-2017 21:40:22.148 -0800 ERROR TailReader - Ignoring path="/opt/script_output_data/folder1/folder2/file_name_01152017_21_40_18.csv" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

I have my props.conf on indexer as well as my forwarder.

0 Karma

hmatthews_splun
Splunk Employee
Splunk Employee

I realise this question is a few months old but hopefully the following will help!

Check your props.conf on the universal forwarder - it could be caused by INDEXED_EXCTRACTIONS=<x>. I had the same recently and narrowed it down to INDEXED_EXCTRACTIONS=<x>.

You'll need the configuration on the indexers, but not on the universal forwarder.

0 Karma

Paolo_Prigione
Builder

INDEXED_EXTRACTIONS are an exception in that the parsing/field extraction is performed on the UF instead of the HWF/IDX.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...