Why error "Unable to import data.File too small to check seekcrc, probably truncated. Will re-read entire file"?

power12 — Fri, 15 Jul 2022 16:57:27 GMT

I am trying to import data reading a file .But I keep getting the below error in internal logs

INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/usr/local/ios/var/logs/PN_Usage_iujj_Jun28.22.10.56.csv'

07-15-2022 11:37:42.256 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/usr/local/ios/var/logs/PN_Usage_iuhg_Jun28.22.16.16.csv'.

inputs

[monitor:///usr/local/ios/var/logs/PN_Usage_*.csv]
index = xyz
sourcetype=ios:pn:usage
#crcSalt = vmr
initCrcLength = 10000

props

[ios:pn:usage]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\"\d+\-\d+\-\d+\_\d+\:\d+
MAX_TIMESTAMP_LOOKAHEAD=17
NO_BINARY_CHECK=null
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true
TIME_FORMAT=%Y-%m-%d_%H:%M
TIME_PREFIX=\"

Sample events:

2022-07-14_15:35, PO@abc, InOctets, 4541070, OutOctets, 12763951, Total MB used, 2.163127625

2022-07-14_15:35, BE@abc, InOctets, 75945647, OutOctets, 650376983, Total MB used, 90.79032875

Is there any other settings I need to include or remove.

Thanks in Advance

Re: Why error "Unable to import data.File too small to check seekcrc, probably truncated. Will re-read entire file&

MuS — Sat, 16 Jul 2022 21:36:32 GMT

Hi there,

Your inputs.conf setting of `initCrcLength = 10000` tells Splunk to read 10000 bytes into the file to validate the seekcrc or if this file was seen before. If your file is smaller than 10000 bytes Splunk will report the message you see and re-index the file. This behaviour is expected as described in the docs https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Inputsconf#MONITOR:

Try to remove the option `initCrcLength` and restart Splunk.

Hope this helps ...

cheers, MuS

topic Why error "Unable to import data.File too small to check seekcrc, probably truncated. Will re-read entire file"? in Getting Data In

Why error "Unable to import data.File too small to check seekcrc, probably truncated. Will re-read entire file"?

Re: Why error "Unable to import data.File too small to check seekcrc, probably truncated. Will re-read entire file&