topic Issue with crcsalt not reindexing files in Getting Data In

Issue with crcsalt not reindexing files

jarlin — Mon, 30 Sep 2019 15:40:07 GMT

A newbie splunker here. I got a doubt about crcsalt as for some reason it's not working for me. I got a task to monitor .conf files for some apps and I made the inputs.conf & props.conf in a server after testing there were some issues so I did crcsalt for it to reindex these files and they did. Now I had to do this again in another server and made an app for it and pushed it to the DX & CM and also towards their respective clusters as well but due to certain circumstances I had to reindex these files with crcsalt the second time but for some reason the files aren't getting reindexed. I changed the sourcetype in props.conf it didn't work still. After foraging through answers.splunk the only answers I got was to clear the fishbucket which is a no go for me, use btprobe which is also a no go or to use crcsalt. Is there any possible way to fix this other than indexing it into a new index? Any help would be appreciated.

Edit: I created a new index hoping that the files would be reindexed but it didn't work as well. Now I'm scratching my head for a reason why it ain't working.

Re: Issue with crcsalt not reindexing files

gfreitas — Wed, 02 Oct 2019 14:52:51 GMT

Hey man, if you're talking about reindexing only one file in a single server you can use the one shot option. You can find some information here: https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html

Re: Issue with crcsalt not reindexing files

jarlin — Wed, 02 Oct 2019 19:05:27 GMT

No, I'm monitoring multiple paths in the same inputs.conf and I'm facing issues with crcsalt. I also created a new index but its not reindexing again. As for one shot option its seems like a very tedious option.

Re: Issue with crcsalt not reindexing files

sideview — Mon, 07 Oct 2019 23:59:40 GMT

What version of Splunk are you running?

I actually hit a maddening problem that sounds like this, quite a few versions back and I resorted to weird things like setting crcSalt to random strings like "reindex this 17" when crcSalt=<SOURCE> mysteriously stopped working. At the time I had the option to clean that index and I think I did. And then the problem never returned but I had since upgraded Splunk.