topic Re: CRCSALT = SOURCE but still getting error "File will not be read". in Getting Data In

CRCSALT = SOURCE but still getting error "File will not be read".

tb5821 — Sun, 07 Jun 2020 00:55:23 GMT

I have my inputs.conf setup like so:

[monitor:///var/log/java]
disabled = 0
index = myindex
sourcetype = metrics_csv
whitelist = metrics.*.csv
CRCSALT = <SOURCE>

But even though each filename is UNIQUE with a timestamp, etc, I still get the error that the "File will not be read"! Thoughts?

ERROR TailReader - File will not be read, is too small to match seekptr checksum ().  Last time we saw this initcrc, filename was different.  You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

Re: CRCSALT = SOURCE but still getting error "File will not be read".

richgalloway — Fri, 29 May 2020 20:45:31 GMT

CRCSALT should be crcSalt.

Re: CRCSALT = SOURCE but still getting error "File will not be read".

tb5821 — Fri, 29 May 2020 21:28:57 GMT

thanks - how do I confirm this is actually working though? I still see the same message in the logs

Re: CRCSALT = SOURCE but still getting error "File will not be read".

codebuilder — Fri, 29 May 2020 22:22:06 GMT

You'll have to cycle the forwarder after correcting the typo.
Afterwards you can verify with tstats.
e.g.

|tstats count where index=myindex by source

Re: CRCSALT = SOURCE but still getting error "File will not be read".

codebuilder — Mon, 01 Jun 2020 01:05:02 GMT

Did this resolve your issue? If so, please accept @richgalloway 's answer so that it can benefit others in the future.

Re: CRCSALT = SOURCE but still getting error "File will not be read".

jaihingorani — Fri, 01 Apr 2022 12:50:22 GMT

Hi @codebuilder @richgalloway

ran into this issue all of a sudden, i am using the same crcSalt=<SOURCE> parameter in my inputs.conf stanza, however its still throwing the same error "File will not be read, is too small to match seekptr checksum (file=<path to file>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

the same inputs stanza has been pushed to another UF, where the logs are flowing fine for the same path. Is there something still missing ?