topic Re: text files being ignored in Getting Data In

text files being ignored

Rajshekhar — Mon, 28 Sep 2020 10:07:50 GMT

We have below monitor stanza in inputs.conf file
[monitor:///usr/sap/IXD/SYS/profile]

disabled = false

index = erp

crcSalt = SOURCE

This profile folder contains 3 important text files DEFAULT.PFL, IXD_DVEBMGS17_spwdfvml0248, START_DVEBMGS17_spwdfvml0248
which we want splunk to monitor. But its monitoring only DEFAULT.PFL file, when searched in indexer its not giving any results, Tried with all wild character search but no use.
Please advice how to solve this issue, this is very critical for us as these files are very important to be monitores in all our several servers.

Re: text files being ignored

Rajshekhar — Mon, 21 Nov 2011 14:12:35 GMT

Also in somefile.out file from other host I see below log

/usr/sap/IX4/SYS/profile/s:key
ignored file (crc conflict, needs crcSalt)/s:key

From above log it should not show this file when searched, but when I searched for this file it gives me results for this file and I can see the file has indexed, which should not have happened I guess..its very strange!
Please help to resolve the above 2 issues.
Thanks in advance!

Re: text files being ignored

_d_ — Mon, 21 Nov 2011 14:24:05 GMT

Try the stanza below:

[monitor:///usr/sap/IXD/SYS/profile] disabled = false index = erp crcSalt = <SOURCE>

Notice that when the literal string <SOURCE> (including the angle brackets) is added, the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Re: text files being ignored

Rajshekhar — Mon, 21 Nov 2011 14:55:58 GMT

Thanks for your update, but it is not working:(

Re: text files being ignored

MHibbin — Mon, 21 Nov 2011 16:51:11 GMT

Are the file permissions correct?

Re: text files being ignored

Rajshekhar — Mon, 21 Nov 2011 17:11:03 GMT

yes, file permissions are correct

Re: text files being ignored

Rajshekhar — Wed, 23 Nov 2011 08:20:12 GMT

Hi,
Can anyone please help to resolve this issue.

Re: text files being ignored

Rob — Tue, 06 Dec 2011 18:25:06 GMT

What _d_ mentioned looks good and I would say that you might want to double check the path and permissions for the files to be monitored as well as the access rights for the Splunk user when running your search, including making sure that the Splunk user has access to the index you are sending these events to.

So using:

[monitor:///usr/sap/IXD/SYS/profile] 
disabled = false 
index = erp 
crcSalt = <SOURCE>

Followed by making sure that when you search that you specify

search index="erp" *

Should be fine as long as all the requirements are met for monitoring all the files. One last thing to consider. Is there any sort of file lock that might be on those files that would prevent Splunk from opening them to index?