topic Re: Monitor input not reading files ? in Getting Data In

Monitor input not reading files ?

szabados — Tue, 13 Oct 2015 07:11:42 GMT

I'm facing an issue with a monitor input like this:
index=myindex
disabled=0
sourcetype=mysourcetype
crcSalt=salt

The problem is, it only reads the first file in that folder. I've tried several times changing the crcSalt, and re-read the folder, the first file gets read every time ,but just the first, nothing else. I've tried adding different files to the folder, and removed the original ones, but the issue still persists. In the log, I see lines like these for the other files:
ERROR TailingProcessor - File will not be read, seekptr checksum did not match
Last time we saw this initcrc, filename was different.

Re: Monitor input not reading files ?

badrinath_itrs — Tue, 13 Oct 2015 07:31:15 GMT

Can you run below command to see what is being monitored.

$SPLUNK_HOME/bin/splunk list monitor

Re: Monitor input not reading files ?

szabados — Tue, 13 Oct 2015 07:41:21 GMT

I checked this already, and my monitor input is being shown here as well.

Re: Monitor input not reading files ?

badrinath_itrs — Tue, 13 Oct 2015 07:56:21 GMT

Hi ,

Please take a look into below answer . You might need to set it to crcSalt = source depending on the content you have in the log files.

crcSalt = <SOURCE>

https://answers.splunk.com/answers/7457/error-tailingprocessor-unable-to-index-file.html

Regards,
Badri

Re: Monitor input not reading files ?

woodcock — Tue, 13 Oct 2015 17:31:35 GMT

By setting crcSalt to the hardcoded value salt, you are telling Splunk to only index the very first file that matches the input stanza. This is because all files will have the same value "salt". Remove this line entirely (or switch to crcSalt =) and it will work fine.