topic Re: crcSalt question - index all in Getting Data In

crcSalt question - index all

renanprado96 — Mon, 23 May 2016 18:49:14 GMT

I already know that without crcSalt Splunk checks the first 256 characters, and the crcSalt = the Splunk checks the source.
But what I do for Splunk not check anything, index all files?

Thank you!!

Re: crcSalt question - index all

jkat54 — Mon, 23 May 2016 19:01:40 GMT

If you did that, it would never stop indexing all files... it wouldnt know what files it has read, and would just keep indexing again and again.

Re: crcSalt question - index all

renanprado96 — Mon, 23 May 2016 19:07:39 GMT

Got it,
In addition to the has more parameters for crc Salt?

Thanks...

Re: crcSalt question - index all

somesoni2 — Mon, 23 May 2016 19:07:45 GMT

IMP, the crcSalt= will do re-indexing of all files. Did you give that a try?

Re: crcSalt question - index all

renanprado96 — Mon, 23 May 2016 19:27:55 GMT

So I would never stop indexing?
The crcSalt has other parameters beyond the ?

Re: crcSalt question - index all

jkat54 — Tue, 29 Sep 2020 09:46:48 GMT

you can use crcSalt=RandomString but this will only make it reindex files that have already been indexed, and it will only index them one new time.

What are you trying to do?

Most people want to use crcSalt=<SOURCE> and use the "Monitor" stanzas in inputs.conf.

I guess if you wanted to, you could greatly reduce the size of your fishbucket aka btree:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

file_tracking_db_threshold_mb = 1

The above would cause there to be a very small fishbucket (which contains the CRCs), and so splunk would fill the fishbucket rapidly and then rotate the data within... effectively "forgetting" very quickly that it had indexed a file.

Re: crcSalt question - index all

renanprado96 — Mon, 23 May 2016 19:44:14 GMT

Got it, do not have much text about Salt crc, so I was confused.

It is possible to create a crc without being the first characters and not the source?
We're having trouble in this part.

Thank you, again.