Getting Data In

Different path from Splunk Universal Forwarder with same log file name, however, cannot recognize one of the path's log file

lsmkelvin
New Member

Here is the details.

Server 1:
path=/appl/abc/log/access.yyyyMMdd.HHmmss.log
Which is ok for Server 1.

Server 2:
path=/appl/def/log/access.yyyyMMdd.HHmmss.log
I extracted Server 2 splunkd.log and the message as below.
"08-30-2012 10:28:11.478 +0800 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/appl/def/log/access.yyyyMMdd.HHmmss.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info."

For those server inputs.conf setting, which are same, just only the path location is different. Also, i indexed to different index as well with using different app.

Can anyone help to fix this problem?

Thanks
Kelvin

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Ismkelvin

the message says it all, the file was ignored because of a CRC match. If you want to index this file you have to add the crcSalt = to your inputs.conf. This will tell Splunk to include the path name in the checksum.

read more about it here and follow the docs; SOURCE must be in angle brackets 😉

but also be warned, that including crcSalt can lead to double indexing of files.

cheers,

MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...