Getting Data In

crcSalt = SOURCE not working as expected

snickered
Path Finder

On my universal forwarder inputs.conf I have: crcSalt = for C:\TEMP. When I add a file it's consumed and sent to my indexer. Then I remove the file from C:\TEMP, restart the universal forwarder and re-add the same file (with the same filename) to C:\TEMP. When I do, it's not consumed again. Isn't crcSalt supposed to allow this?

It seems like crcSalt is almost working because when I simply change the filename and add it to C:\TEMP the file is indexed again.

Am I mistaken? Shouldn't crcSalt = allow me to index the exact same file with the same filename more than once?

In my inputs.conf I have SOURCE capitalized. For some reason I can't capitalize in the question.

Tags (1)
0 Karma
1 Solution

Drainy
Champion

You're slightly misunderstanding the purpose of the crcSalt, all it does is add the file path to the salt used to generate the CRC... which if its the same name and same folder will be identical!

If you're looking to reindex a file thats already been indexed you need to clear out the fishbucket by running the following command from the forwarder $SPLUNK_HOME/bin

./splunk clean all

Beware though, this will make the forwarder reindex EVERYTHING its already read so be careful. Also it will reset the password to changeme if you had changed it.

View solution in original post

Drainy
Champion

You're slightly misunderstanding the purpose of the crcSalt, all it does is add the file path to the salt used to generate the CRC... which if its the same name and same folder will be identical!

If you're looking to reindex a file thats already been indexed you need to clear out the fishbucket by running the following command from the forwarder $SPLUNK_HOME/bin

./splunk clean all

Beware though, this will make the forwarder reindex EVERYTHING its already read so be careful. Also it will reset the password to changeme if you had changed it.

yannK
Splunk Employee
Splunk Employee
0 Karma

snickered
Path Finder

Ah! Not sure how I missed that in the documentation. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...