Splunk is not indexing some .csv files.

Available Languages

Updated:September 28, 2026
Document ID:SPLK044385

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

After setting monitor stanzas in the Universal Forwarder to monitor CSV files and other files with structured data, Splunk is not ingesting these files.


Investigation

While indexing CSV files, Splunk is not indexing some of them showing below error in Splunkd.log

ERROR TailReader - Ignoring path="/var/log/tomcat/suwinet-access.log" due to: Bug during applyPendingMetadata, header processor does not own the 
indexed extractions confs. 


The forwarder stopped processing this log until restarted the Splunk forwarder process.


Resolution

The Universal Forwarders was trying to extract fields and they can only filter events, remove the configuration on your props.conf that is extracting the fields.

To extract fields with a forwarder you would need a heavy forwarder.


Splunk Answers
Error : Bug during applyPendingMetadata, header processor does not own the indexed extractions confs

Revision History

Revision Publish Date Comments
1.0
28-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products