Splunk Search

Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

sandipan11
Path Finder

I am getting "Bug during applyPendingMetadata, header processor does not own the indexed extractions confs" so every file I am trying to ingest is ignoring. I am using Universal Forwarder to ingest data.

03-29-2016 22:22:27.818 -0700 ERROR TailingProcessor - Ignoring path="/opt/apps/splunk_data/uf2/data/bandy.txt" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

Can any one have solution for this?

abhinav_maxonic
Path Finder

I am also getting this error for my csv files. Splunk is not indexing some of csv files. All for them are 117KB in size. I am creating the CSV on linux using command -

ssh admin@machine1 "some command" > /opt/script_output_data/folder1/folder2/file_name_`date +\%m\%d\%Y_\%H_\%M_\%S`.csv

Error : 01-15-2017 21:40:22.148 -0800 ERROR TailReader - Ignoring path="/opt/script_output_data/folder1/folder2/file_name_01152017_21_40_18.csv" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

I have my props.conf on indexer as well as my forwarder.

0 Karma

hmatthews_splun
Splunk Employee
Splunk Employee

I realise this question is a few months old but hopefully the following will help!

Check your props.conf on the universal forwarder - it could be caused by INDEXED_EXCTRACTIONS=<x>. I had the same recently and narrowed it down to INDEXED_EXCTRACTIONS=<x>.

You'll need the configuration on the indexers, but not on the universal forwarder.

0 Karma

Paolo_Prigione
Builder

INDEXED_EXTRACTIONS are an exception in that the parsing/field extraction is performed on the UF instead of the HWF/IDX.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...