Deployment Architecture

Splunk CRC check

ankithreddy777
Contributor

I have one log file at particular path on server1. I am forwarding it to splunk index=index1.
I have another log file on server2, whose path and name of file is same as that of log file on server1. I am forwarding it to same index=index=1.

But I can see only the log file ingested from server1 but not from server 2.

As per CRC check it will check first 256 bytes. But this check is at forwarder level or the indexer level.
If it is at forwarder level, why it is not picking the same log on different server/forwarder.
If it is at indexer level, how to handle this kind of situation to ingest logs on different servers with same name, path and same first 256 bytes. Here I cannot use crcSalt as my logs are rotating.

0 Karma

woodcock
Esteemed Legend

The CRC check is at a forwarder level (more accurately, at a splunk-instance level, since you can run more than one splunk instance on a forwarder). Start with splunk list monitor and them move to btool to check your configurations if it does not show up as an input.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...