https://community.splunk.com/t5/Getting-Data-In/Why-am-I-getting-checksum-errors-on-certain-hosts-and-how-to/m-p/156994#M31807 <P>This is might unusual. The system's own logfiles are having seekpointer mismatches.</P> <P>This suggests something unpleasant, like two splunks fighting over one set of logfile dirs, sysadmins manually modifying the logfiles, a choice to manually modify (eg rotate) splunk logfiles outside of splunk, or problems in the filesystem the data is stored on.</P> Fri, 10 Oct 2014 09:10:56 GMT jrodman 2014-10-10T09:10:56Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-getting-checksum-errors-on-certain-hosts-and-how-to/m-p/156993#M31806 <P>I'm trying to create a dashboard for missing universal Forwarders.<BR /> I tried using _internal logs, but for a few of the hosts I'm not getting internal logs regularly.</P> <P>I'm getting the below entries often on those hosts. What does it mean. What do I need to do?<BR /> Could anyone please explain?</P> <PRE><CODE>10-09-2014 08:30:20.317 +0100 INFO WatchedFile - Will begin reading at offset=24997255 for file='/opt/splunkforwarder/var/log/splunk/metrics.log.1'. host=abc source=/opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype = splunkd 10-09-2014 08:30:19.781 +0100 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/splunkforwarder/var/log/splunk/metrics.log'. host = abc source = /opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype = splunkd 10-09-2014 08:30:19.756 +0100 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/splunkforwarder/var/log/splunk/metrics.log'. host = abc source = /opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype = splunkd </CODE></PRE> Thu, 09 Oct 2014 07:53:29 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-getting-checksum-errors-on-certain-hosts-and-how-to/m-p/156993#M31806 splunkn 2014-10-09T07:53:29Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-getting-checksum-errors-on-certain-hosts-and-how-to/m-p/156994#M31807 <P>This is might unusual. The system's own logfiles are having seekpointer mismatches.</P> <P>This suggests something unpleasant, like two splunks fighting over one set of logfile dirs, sysadmins manually modifying the logfiles, a choice to manually modify (eg rotate) splunk logfiles outside of splunk, or problems in the filesystem the data is stored on.</P> Fri, 10 Oct 2014 09:10:56 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-getting-checksum-errors-on-certain-hosts-and-how-to/m-p/156994#M31807 jrodman 2014-10-10T09:10:56Z