topic Re: Splunk Log ingestion issues in Monitoring Splunk

Splunk Log ingestion issues

Prakash493 — Thu, 16 May 2019 14:39:49 GMT

Currently i am facing a issue , i am monitoring a directory that has over 14000 files i am getting few files are ingesting to splunk and few files are not ingesting , currently i am using these two stanzas in my input.conf file disabled = false
recursive = true , anyone has face similar issue ?

Re: Splunk Log ingestion issues

koshyk — Thu, 16 May 2019 15:11:01 GMT

This could be related to multiple issues
1. crcSalt => By default, the Splunk only performs CRCs against the first few lines of a file. so if the lines are exactly same on these files for the default settings, it may NOT index
2. initCrcLength => default is 256 bytes ; How much of a file, in bytes, that the input reads before trying to
identify whether it is a file that has already been seen. You might want to adjust this if you have many files with common headers
3. Do a btool of inputs to see if your settings are overriden in some other app

you need to give the exact samples/btool output in the question for us to help you further

Good link to read about => https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf
and of course inputs.conf specification

Re: Splunk Log ingestion issues

Prakash493 — Thu, 16 May 2019 21:36:27 GMT

so do i need to add crcSalt= or just crcSalt =>