<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic crcSalt noob questions in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/crcSalt-noob-questions/m-p/94096#M19587</link>
    <description>&lt;P&gt;I'm going to tie a few questions into 1 as they all relate to crcSalt!&lt;/P&gt;

&lt;OL&gt;
&lt;LI&gt;&lt;P&gt;The doco says "copy stanza from default to local".&lt;BR /&gt;
My problem is that with a GUI built forwarder reading a windows folder and sub folders - I can't see a specific monitor stanza that I am editing.&lt;BR /&gt;
Do I &lt;BR /&gt;
a:  Just put a stanza [MONITOR] into the local inputs.conf with the crcSalt=&lt;FIELD&gt; line in it and hope it works?&lt;BR /&gt;
b:  Try to find out what the actual [MONITOR] stanza should be and re-create that in the local inputs.conf?&lt;/FIELD&gt;&lt;/P&gt;&lt;/LI&gt;
&lt;LI&gt;&lt;P&gt;The same file system includes logs that role over - how do I make sure that the crcSalt implementation doesn't force re-reading of those files?  I understand that "source" will force resalting of every file - how do I make it:&lt;BR /&gt;
a:  Salt the files I want; and&lt;BR /&gt;
b:  not Salt rolling log files?&lt;/P&gt;&lt;/LI&gt;
&lt;/OL&gt;

&lt;P&gt;Thanks in advance&lt;/P&gt;

&lt;P&gt;Steve&lt;/P&gt;</description>
    <pubDate>Thu, 18 Oct 2012 03:52:12 GMT</pubDate>
    <dc:creator>StevenClarke</dc:creator>
    <dc:date>2012-10-18T03:52:12Z</dc:date>
    <item>
      <title>crcSalt noob questions</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/crcSalt-noob-questions/m-p/94096#M19587</link>
      <description>&lt;P&gt;I'm going to tie a few questions into 1 as they all relate to crcSalt!&lt;/P&gt;

&lt;OL&gt;
&lt;LI&gt;&lt;P&gt;The doco says "copy stanza from default to local".&lt;BR /&gt;
My problem is that with a GUI built forwarder reading a windows folder and sub folders - I can't see a specific monitor stanza that I am editing.&lt;BR /&gt;
Do I &lt;BR /&gt;
a:  Just put a stanza [MONITOR] into the local inputs.conf with the crcSalt=&lt;FIELD&gt; line in it and hope it works?&lt;BR /&gt;
b:  Try to find out what the actual [MONITOR] stanza should be and re-create that in the local inputs.conf?&lt;/FIELD&gt;&lt;/P&gt;&lt;/LI&gt;
&lt;LI&gt;&lt;P&gt;The same file system includes logs that role over - how do I make sure that the crcSalt implementation doesn't force re-reading of those files?  I understand that "source" will force resalting of every file - how do I make it:&lt;BR /&gt;
a:  Salt the files I want; and&lt;BR /&gt;
b:  not Salt rolling log files?&lt;/P&gt;&lt;/LI&gt;
&lt;/OL&gt;

&lt;P&gt;Thanks in advance&lt;/P&gt;

&lt;P&gt;Steve&lt;/P&gt;</description>
      <pubDate>Thu, 18 Oct 2012 03:52:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/crcSalt-noob-questions/m-p/94096#M19587</guid>
      <dc:creator>StevenClarke</dc:creator>
      <dc:date>2012-10-18T03:52:12Z</dc:date>
    </item>
    <item>
      <title>Re: crcSalt noob questions</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/crcSalt-noob-questions/m-p/94097#M19588</link>
      <description>&lt;P&gt;hi StevenClarke&lt;/P&gt;

&lt;P&gt;why do you want to use crcSalt? usually one just set it up if there are problems for example with 'file to small' messages.&lt;/P&gt;

&lt;P&gt;cheers,&lt;BR /&gt;
MuS &lt;/P&gt;</description>
      <pubDate>Thu, 18 Oct 2012 06:57:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/crcSalt-noob-questions/m-p/94097#M19588</guid>
      <dc:creator>MuS</dc:creator>
      <dc:date>2012-10-18T06:57:28Z</dc:date>
    </item>
    <item>
      <title>Re: crcSalt noob questions</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/crcSalt-noob-questions/m-p/94098#M19589</link>
      <description>&lt;P&gt;That's just it MuS - I'm getting the file too small errors and more importantly similar config files in subdirectories not being indexed due crc error (looks the same).&lt;/P&gt;</description>
      <pubDate>Thu, 18 Oct 2012 20:16:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/crcSalt-noob-questions/m-p/94098#M19589</guid>
      <dc:creator>StevenClarke</dc:creator>
      <dc:date>2012-10-18T20:16:16Z</dc:date>
    </item>
  </channel>
</rss>

