topic Re: crcSalt issue in Getting Data In

Does crcSalt cause monitoring stanzas to only consider one "backup" file name?

sureshkumaar — Thu, 09 Mar 2023 19:45:17 GMT

Hi All,

Having these 2 monitor stanze in one inputs.conf, but able to get data only for latest one monitor stanza.

In both the file names strings are similar but numbers are changing

Is that because of the crcSalt, it's considering only one "Backup*" file name?

Also do the sourcetype needs to be different incase if we are adding "Backup*" in monitor stanza?

File name for first stanza - BackupJobSummaryReport_3696_6883300_1588_1678235411

File name for second stanza - BackupJobSummaryReport_19068_455837_9176_1678233614

[monitor://\\A11FLSCOMMVAULT\commvault_reports\Final_Report\Backup*]
index = backup
disabled = 0
sourcetype = commvault
crcSalt = <SOURCE>

[monitor://\\A11FLSCOMMVAULT\commvault_reports\LISTAPAC\Backup*]
disabled = 0
index = backup
sourcetype = commvault
crcSalt = <SOURCE>

Re: crcSalt issue

gcusello — Wed, 08 Mar 2023 11:46:19 GMT

Hi @sureshkumaar,

if you have different file names you should read both the files.

Only one question: have your files an extension (e.g. ".log")?

In linux this path is correct, but in Windows you have to add ".*" at the end.

then, the double backslash at the beginning of "A11FLSCOMMVAULT" means that this is a nework path?

if not you havev to add also "c:".

ciao.

Giuseppe

Re: crcSalt issue

sureshkumaar — Wed, 08 Mar 2023 12:34:23 GMT

Hi @gcusello

Yes file names are different, as i mentioned earlier strings will remain as it is and the numbers will keep changing.

But able to get only data from one stanza, the other stanza not forwarding data.

I created separate app and tested by creating a file and added input to the file manually and able to get the data.

Having in same app wasn't working, is that because of same sourcetype using for 2 different sources in the inputs.conf???

the extension is "*.csv"

yes it's the network path works from the windows server

Re: crcSalt issue

gcusello — Wed, 08 Mar 2023 13:03:52 GMT

Hi @sureshkumaar,

non you don't need to use two different sourcetype, you could also use one monitor stanza for both the inputs.

I'd add also the extention to the path:

[monitor://\\A11FLSCOMMVAULT\commvault_reports\*\Backup*.csv] index = backup disabled = 0 sourcetype = commvault crcSalt = <SOURCE>

Anyway, the crcSalt is useful if you have the same content in more than one file, if the contetnts are different, youdon't need to use it: please try also without crcSalt.

Ciao.

Giuseppe

Re: crcSalt issue

PickleRick — Wed, 08 Mar 2023 13:25:40 GMT

See what

splunk list monitor

and

splunk list inputstatus

say. If they don't list your files, there's something wrong with settings because your files don't match. If the file is matched but not read due to some reason (too old, not considered as changed and so on), you should see that.

Re: crcSalt issue

scelikok — Wed, 08 Mar 2023 13:59:11 GMT

Hi @sureshkumaar,

monitor inputs are case-sensitive. Is it possible directory or filenames are not the same as \\A11FLSCOMMVAULT\commvault_reports\LISTAPAC\Backup* ?