topic Logs were not indexing in Splunk from a particular path in Getting Data In

Logs were not indexing in Splunk from a particular path

pavanae — Tue, 29 Sep 2020 07:22:05 GMT

The logs from the source="/tpo/jboss/server/shared/logs/*cap/server.log" were not properly getting into the index and i continuously seeing the following logs in the splunkd.log everyday at 1 A.M

INFO WatchedFile - Will begin reading at offset=0 for file="/tpo/jboss/server/shared/logs/*cap/server.log"
INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file="/tpo/jboss/server/shared/logs/*cap/server.log"
INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file="/tpo/jboss/server/shared/logs/*cap/server.log"

Please do suggest what needs to be done to get those logs

Re: Logs were not indexing in Splunk from a particular path

pavanae — Thu, 24 Sep 2015 15:29:58 GMT

Missed the Following log to mention in the above question.

ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/tpo/jboss/server/shared/logs/*cap/server.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at

Re: Logs were not indexing in Splunk from a particular path

somesoni2 — Thu, 24 Sep 2015 19:28:44 GMT

Above error means that the initcrc handler (default first 250 bytes of the file) which Splunk uses to identify a file that needs monitoring is not unique and it's not going to ingest the data.

How is the file generated and does it have a common header at the start which will be same for every file/copy of the file?

Re: Logs were not indexing in Splunk from a particular path

pavanae — Wed, 07 Sep 2016 14:49:29 GMT

This happened due to the permission issues on the particular paths in the forwarder. It got resolved after providing the required permissions for those paths.