topic Re: Splunk monitor mode query in Getting Data In

Splunk monitor mode query

Mansi24 — Mon, 06 Jan 2014 11:19:05 GMT

i have indexed data from a directory in monitor mode ,and while checking the status of files being indexed i found an error " ignored file (crc conflict, needs crcSalt)" in the filestatus.
what does this error signifies and how to rectify it?

Re: Splunk monitor mode query

somesoni2 — Mon, 06 Jan 2014 14:53:28 GMT

For every file, splunk creates a CRC (cyclic redundancy check) handler, which is based on first few line of the file. This helps prevent re-indexing of same file (even though its renamed, especially in case of files which are getting rolled over). It seems that the files being ignored by Splunk, in your case ,have similar first few lines (characters) causing Splunk to ignore them.

To make Splunk read all the files in a directory regardless of similar files, you need to add "crcSalt = " in your input.conf stanza for the directory being monitored.

[monitor://C:\MyDirectory\*.log]
disabled = false
followTail = 0
sourcetype = myindex
crcSalt = <SOURCE>

Beware that, with this setting Splunk will index all the files, even though they have been renamed, rolled over.

Re: Splunk monitor mode query

Mansi24 — Wed, 08 Jan 2014 07:10:05 GMT

thanks somesoni2,

just to confirm that the written should be as it is or so we have to give the actual source from where the data is accessed for ex. if data source is my own system than i have to give my as .

Re: Splunk monitor mode query

somesoni2 — Wed, 08 Jan 2014 12:25:28 GMT

It has to be written as it is (string literal). And don't forget to either restart splunk instance or refresh configuration using "http://splunk-server:port/en-US/debug/refresh"