Absent Member.
Absent Member.
667 views

FlexConnector Parser - Fatal Exception - Unknown State 2

I have created a FlexConnector to log data from a *.csv file in a directory. I have got the connector working but it is not parsing any data. The log says that the file is processed correctly but I can only see an empty event in my ArcSight Logger. When checking the agent.out.wrapper.log and agent.log it is getting a Fatal Exception Error - Unknown State with state 2. I can't find anything about parser states in the documentation or on the software support site. I've attached my *.properties file for reference.

agent.out.wrapper.log

INFO   | jvm 1    | 2017/03/31 11:14:32 | FATAL EXCEPTION:

INFO   | jvm 1    | 2017/03/31 11:14:33 | Parser : Unknown State !(

agent.log

[2017-03-31 11:14:32,669][FATAL][default.com.arcsight.agent.sdk.a.q][Tokenize] Parser : Unknown State !(  with state :2).  Line:"...***redacted****

[2017-03-31 11:14:32,669][ERROR][default.com.arcsight.agent.baseagents.a.a.a][processLine] [java.lang.RuntimeException: Parser : Unknown State !(  with state :2).  Line:" ...***redacted***

at com.arcsight.agent.sdk.a.q.a(q.java:450)

at com.arcsight.agent.sdk.a.q.k(q.java:418)

at com.arcsight.agent.parsers.h.f(h.java:397)

at com.arcsight.agent.parsers.h.b(h.java:755)

at com.arcsight.agent.parsers.h.d(h.java:806)

at com.arcsight.agent.baseagents.a.a.a.e(a.java:202)

at com.arcsight.agent.baseagents.a.a.a.a(a.java:186)

at com.arcsight.agent.baseagents.a.m.run(m.java:860)

at java.lang.Thread.run(Thread.java:745)

Labels (3)
0 Likes
3 Replies
Commodore
Commodore

Hi,

I think the problem in these strings:

delimiter=\t

comments.start.with=\#

From (page 80):

Property

Description

delimiter

This property specifies which character delimits each of the tokens of the file. In

this example, you would set this property to a comma (,) since the tokens are

separated by a comma. Other possible values are:

delimiter= backslash ( \ ); note that there is a space after the backslash (\)

delimiter= pipe ( | )

delimiter= comma ( , )

So maybe you cannot define delimiter=\t.

Or you can try

delimeter=\\t

And you should not escape comment.start.with:

comments.start.with=#

0 Likes

Hello, have you resolved this error? I'm having exactly same problem with csv parser and haven't find any solution...but I have just simple csv with delimiter=, text.qualifier="
0 Likes

So in my case agent[].encoding=UTF16 did the trick
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.