topic Re: Batch input not working. Please help troubleshoot it in Getting Data In

Batch input not working. Please help troubleshoot it

dm1 — Tue, 03 Aug 2021 04:30:32 GMT

There is a csv file I had added to a a directory which HF monitors.

That input is set as Batch input.

Because there was some issue with the data was getting formatted, I deleted the results from the search head using | delete command.

After that to re-ingest, I followed same procedue to reingest the csv file.

After the file is added to the directory, it gets deleted due to the move to sink hole policy.

However, when I do a search for the same log, nothing shows up.

Can someone please help why this is happening and how it can be fixed ?

gcusello — Tue, 03 Aug 2021 10:07:27 GMT

by default, Splunk doesn't permit to index a file twice.

So if you deleted the logs from a file in Splunk, to reindex them you have two options:

index it manually using the guided procedure [Settings -- Add Data];
change the name of the file, modify your inputs.conf stanza adding "crcSal = <SOURCE>" and restart Splunk on HF.

Ciao.

Giuseppe

dm1 — Tue, 03 Aug 2021 10:07:49 GMT

Adding the below setting in batch stanza within inputs.conf helped me re-ingest the same file

initCrcLength = 1028

FYI, the value cannot be less than 256 or more than 1048576.

dm1 — Tue, 03 Aug 2021 10:08:56 GMT

Thanks for your reply @gcusello . I have posted the solution that helped fix my issue.

gcusello — Tue, 03 Aug 2021 10:16:11 GMT

Good for you, see next time!

Ciao and Happy splunking.

Giuseppe

P.S.: Karma points are appreciated by all the Contributors 😉