Getting Data In

Can splunk read logs in CSV format?

balbano
Contributor

Hi, we are currently testing a Palo Alto app sec firewall and are sending some test logs over to the central indexer in CSV format. Can splunk read CSV files?

The splunkd.log file is giving me somewhat of an error stating the following:

05-25-2010 14:21:33.678 ERROR TailingProcessor - Ignoring path due to: File will not be read, is too small to match seekptr checksum (file=PATHTOMYFILES). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or contact Splunk Support for more info.

Let me know. Thanks!

Brian

Tags (2)
0 Karma
1 Solution

Nicholas_Key
Splunk Employee
Splunk Employee

sure. please test if it works with

crcSalt = <SOURCE>

in the particular stanza of your app's inputs.conf

View solution in original post

balbano
Contributor

Doesn't look like it worked. Here is my stanza:

[monitor:///pathtomyfiles]
disabled = false
host =
host_segment = 3
index = myindex
sourcetype = mysourcetype
crcSalt = /pathtomyfiles

Is this correct syntax? not seeing the error message anymore but it still doesn't look like the files are being indexed.

Brian

0 Karma

balbano
Contributor

and Lowell since this was a test sample of csv logs the impact was not great but in the future I will definitely keep that in mind!!! Thanks again!!!

0 Karma

balbano
Contributor

sweet... that worked!!!!!!!!! Thanks GUYS!!!!!

0 Karma

Lowell
Super Champion

Also, keep in mind that anytime you change crcSalt you are likely to re-index all your files. You should also be aware that setting crcSalt = <SOURCE> means that if you rotate your log files they may be indexed again. Normally splunk detects and handles this automatically, but using <SOURCE> will effectively disable this feature. So you may need to update your rotation scheme to move log files to a different folder, or make sure your monitor is only looking at your non-rotated files. Just a heads up.

Lowell
Super Champion

No, you want the literal value "<SOURCE>". That is a special value with a special meaning. Take a look at http://www.splunk.com/base/Documentation/4.1.2/Admin/Inputsconf

Nicholas_Key
Splunk Employee
Splunk Employee

sure. please test if it works with

crcSalt = <SOURCE>

in the particular stanza of your app's inputs.conf

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...