https://community.splunk.com/t5/Getting-Data-In/Is-crcSalt-still-supported/m-p/44867#M8416 <P>I'm trying to index Nessus and Snort rules for use in cross-correlation of security events. In previous versions of Splunk, I had to add an entry in props.conf (crcSalt = <SOURCE>) to ensure that Splunk would reindex the entire file any time the contents changed.</SOURCE></P> <P>But now when I startup Splunk running 4.3.1, I get errors about a potential syntax error:</P> <P>Possible typo in stanza [nessus_plugins] in /opt/splunk/etc/apps/ResponsysSecurityConsole/local/props.conf, line 5: crcSalt = <SOURCE></SOURCE></P> <P>Is this option still supported? If not, what can I do to ensure that Splunk always indexes the complete file when any changes to it are detected?</P> <P>Thx.</P> <P>Craig</P> Mon, 07 May 2012 17:29:56 GMT ontai 2012-05-07T17:29:56Z https://community.splunk.com/t5/Getting-Data-In/Is-crcSalt-still-supported/m-p/44867#M8416 <P>I'm trying to index Nessus and Snort rules for use in cross-correlation of security events. In previous versions of Splunk, I had to add an entry in props.conf (crcSalt = <SOURCE>) to ensure that Splunk would reindex the entire file any time the contents changed.</SOURCE></P> <P>But now when I startup Splunk running 4.3.1, I get errors about a potential syntax error:</P> <P>Possible typo in stanza [nessus_plugins] in /opt/splunk/etc/apps/ResponsysSecurityConsole/local/props.conf, line 5: crcSalt = <SOURCE></SOURCE></P> <P>Is this option still supported? If not, what can I do to ensure that Splunk always indexes the complete file when any changes to it are detected?</P> <P>Thx.</P> <P>Craig</P> Mon, 07 May 2012 17:29:56 GMT https://community.splunk.com/t5/Getting-Data-In/Is-crcSalt-still-supported/m-p/44867#M8416 ontai 2012-05-07T17:29:56Z https://community.splunk.com/t5/Getting-Data-In/Is-crcSalt-still-supported/m-p/44868#M8417 <P>Should be fine. I believe it's crcSalt = &lt;SOURCE&gt;. Needs to be capitilized. And you would put it in inputs.conf.</P> Mon, 07 May 2012 17:41:14 GMT https://community.splunk.com/t5/Getting-Data-In/Is-crcSalt-still-supported/m-p/44868#M8417 sdaniels 2012-05-07T17:41:14Z