topic crcSalt = SOURCE not working as expected in Getting Data In

crcSalt = SOURCE not working as expected

snickered — Thu, 28 Feb 2013 22:43:22 GMT

On my universal forwarder inputs.conf I have: crcSalt = for C:\TEMP. When I add a file it's consumed and sent to my indexer. Then I remove the file from C:\TEMP, restart the universal forwarder and re-add the same file (with the same filename) to C:\TEMP. When I do, it's not consumed again. Isn't crcSalt supposed to allow this?

It seems like crcSalt is almost working because when I simply change the filename and add it to C:\TEMP the file is indexed again.

Am I mistaken? Shouldn't crcSalt = allow me to index the exact same file with the same filename more than once?

In my inputs.conf I have SOURCE capitalized. For some reason I can't capitalize in the question.

Re: crcSalt = SOURCE not working as expected

Drainy — Thu, 28 Feb 2013 22:51:56 GMT

You're slightly misunderstanding the purpose of the crcSalt, all it does is add the file path to the salt used to generate the CRC... which if its the same name and same folder will be identical!

If you're looking to reindex a file thats already been indexed you need to clear out the fishbucket by running the following command from the forwarder $SPLUNK_HOME/bin

./splunk clean all

Beware though, this will make the forwarder reindex EVERYTHING its already read so be careful. Also it will reset the password to changeme if you had changed it.

Re: crcSalt = SOURCE not working as expected

snickered — Fri, 01 Mar 2013 00:11:09 GMT

Ah! Not sure how I missed that in the documentation. Thanks.

Re: crcSalt = SOURCE not working as expected

yannK — Fri, 01 Mar 2013 16:31:39 GMT

for selective fishbucket cleaning, take a look at
http://splunk-base.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder/72564