topic Re: ERROR TailingProcessor - File will not be read in Getting Data In

ERROR TailingProcessor - File will not be read

mtamayo79 — Mon, 09 Sep 2013 21:17:22 GMT

Hi,

I,am having problem with the configuration inputs.conf file, I'm monitoring remote computer with universal forwarder.

Remote host (monitoring):
Ditectory E:\SQL\Audit\Log
Files:Audit0001.log.......Audit0010.log
Log: ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=E:\SQL\Audit\Log\Audit0010.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

The splunk server, Inputs.conf:

[monitor://E:\SQL\Audit\Log]E:\SQL\Audit\Log]
crcSalt = <//E:\SQL\Audit\Log]E:\SQL\Audit\Log>

I try, but its not works

Re: ERROR TailingProcessor - File will not be read

yannK — Mon, 09 Sep 2013 22:29:19 GMT

the exact use is actually the word <SOURCE>.

[monitor://E:\SQL\Audit\Log]
crcSalt = <SOURCE>

Re: ERROR TailingProcessor - File will not be read

kristian_kolb — Tue, 10 Sep 2013 05:19:35 GMT

removed them. 🙂

Re: ERROR TailingProcessor - File will not be read

mtamayo79 — Tue, 10 Sep 2013 13:50:35 GMT

[monitor://E:SQL_Audit_Log]
crcSalt = <>
</>

Re: ERROR TailingProcessor - File will not be read

MuS — Tue, 10 Sep 2013 14:05:11 GMT

use it like yannK wrote:

crcSalt = <SOURCE>

SOURCE is NO placeholder 😉