I am getting "Bug during applyPendingMetadata, header processor does not own the indexed extractions confs" so every file I am trying to ingest is ignoring. I am using Universal Forwarder to ingest data.
03-29-2016 22:22:27.818 -0700 ERROR TailingProcessor - Ignoring path="/opt/apps/splunk_data/uf2/data/bandy.txt" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.
Can any one have solution for this?
I am also getting this error for my csv files. Splunk is not indexing some of csv files. All for them are 117KB in size. I am creating the CSV on linux using command -
ssh admin@machine1 "some command" > /opt/script_output_data/folder1/folder2/file_name_`date +\%m\%d\%Y_\%H_\%M_\%S`.csv Error : 01-15-2017 21:40:22.148 -0800 ERROR TailReader - Ignoring path="/opt/script_output_data/folder1/folder2/file_name_01152017_21_40_18.csv" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions confs.
I have my props.conf on indexer as well as my forwarder.
I realise this question is a few months old but hopefully the following will help!
props.conf on the universal forwarder - it could be caused by
INDEXED_EXCTRACTIONS=<x>. I had the same recently and narrowed it down to
You'll need the configuration on the indexers, but not on the universal forwarder.
INDEXED_EXTRACTIONS are an exception in that the parsing/field extraction is performed on the UF instead of the HWF/IDX.