topic Re: csv files are not getting indexed in Getting Data In

csv files are not getting indexed

karthikTIL — Mon, 30 Jun 2014 08:11:03 GMT

hi,
I have lot of csv files under a directory "/opt/splunk/splunkdata/June2014". when i ask splunk to index complete directory, it does not show many files in "search". is it because most of my files have same contents ? How do i make splunk ignore this? fyi., my file names are different.
should i modify crcSalt under "/opt/splunk/etc/system/default" ?if so, to what value?

Re: csv files are not getting indexed

amitkr0201 — Mon, 30 Jun 2014 10:46:34 GMT

crcSalt = <SOURCE>

should help you.
More about that here

Re: csv files are not getting indexed

karthikTIL — Mon, 28 Sep 2020 16:58:10 GMT

HI Amit,

inputs.conf under "/opt/splunk/etc/system/default" is already having "crcSalt = " in two places. Do i need to replace source inside angled bracket with the directory of my csv files "opt/splunk/splunkdata/June2014" which is my source?I did and restarted splunk but it did not help. please let me know.
Snippet of inputs.conf file is below

[batch://$SPLUNK_HOME/var/spool/splunk]
move_policy = sinkhole
crcSalt =

[batch://$SPLUNK_HOME/var/spool/splunk/...stash_new]
queue = stashparsing
sourcetype = stash_new
move_policy = sinkhole
crcSalt =

Re: csv files are not getting indexed

karthikTIL — Tue, 01 Jul 2014 01:18:26 GMT

HI,

i was able to solve this problem. there were many input.conf files in different directories as mentioned below and i included crcSalt= in all these files and restarted splunk and it worked.

/opt/splunk/etc/apps/launcher/local/inputs.conf
/opt/splunk/etc/system/local/inputs.conf
/opt/splunk/etc/system/default/inputs.conf

Re: csv files are not getting indexed

amitkr0201 — Thu, 03 Jul 2014 09:27:30 GMT

/opt/splunk/etc/system/default/inputs.conf

Any customization to this file might be overwritten if splunk is upgraded.

Better stick changes in

/opt/splunk/etc/system/local/inputs.conf only