topic Re: File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. in Splunk Search

File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

santosh_hb — Tue, 29 Sep 2020 19:17:50 GMT

I am getting the following error due to which, the log file is not getting indexed daily.

Log file name is like: db_20180419.log, db_20180420.log...and so-on (Log rotation file)

File will not be read, seekptr checksum did not match (file=C:.....\test_date.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

So, my question is: do I need to set both "initCrcLen" and "crcSalt" parameters or I can just set "initCrcLen".
In case, I need to set "crcSalt", how to set it for source=C:\logs\db_*.log
Could you help me with an sample for the above source.
regards, Santosh

Re: File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

xpac — Mon, 30 Apr 2018 10:33:26 GMT

You could either go with crcSalt or initCrcLen.
As your filenames keep changing, the easiest would be a inputs.conf like this:

[monitor:yourfilename]
crcSalt = <SOURCE>

It will just use the (always different) filename as a salt, so the checksum will differ for each new file - that should solve your problem.
If you had the same issue, but the filename would always be the same, you would have to raise the initCrcLen up to the point where the file is actually different.

Re: File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

FrankVl — Mon, 30 Apr 2018 11:07:03 GMT

You might want to put that inputs.conf example as code, now the <SOURCE> setting for the crcSalt dissapears 🙂

Re: File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

xpac — Mon, 30 Apr 2018 11:11:01 GMT

Thanks, I missed that and then it ate my precious config. 😉

Re: File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

santosh_hb — Thu, 10 May 2018 08:59:39 GMT

Thanks guys..Its working.

Re: File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

xpac — Thu, 10 May 2018 23:27:56 GMT

Then please upvote/accept the answer. 🙂