Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

[sandipan11]

I am getting "Bug during applyPendingMetadata, header processor does not own the indexed extractions confs" so every file I am trying to ingest is ignoring. I am using Universal Forwarder to ingest data.

03-29-2016 22:22:27.818 -0700 ERROR TailingProcessor - Ignoring path="/opt/apps/splunk_data/uf2/data/bandy.txt" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

Can any one have solution for this?

[abhinav_maxonic]

I am also getting this error for my csv files. Splunk is not indexing some of csv files. All for them are 117KB in size. I am creating the CSV on linux using command -

ssh admin@machine1 "some command" > /opt/script_output_data/folder1/folder2/file_name_`date +\%m\%d\%Y_\%H_\%M_\%S`.csv

Error : 01-15-2017 21:40:22.148 -0800 ERROR TailReader - Ignoring path="/opt/script_output_data/folder1/folder2/file_name_01152017_21_40_18.csv" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.

I have my props.conf on indexer as well as my forwarder.

[hmatthews_splun]

I realise this question is a few months old but hopefully the following will help!

Check your props.conf on the universal forwarder - it could be caused by INDEXED_EXCTRACTIONS=<x>. I had the same recently and narrowed it down to INDEXED_EXCTRACTIONS=<x>.

You'll need the configuration on the indexers, but not on the universal forwarder.

[Paolo_Prigione]

INDEXED_EXTRACTIONS are an exception in that the parsing/field extraction is performed on the UF instead of the HWF/IDX.