Splunk CRC check

[ankithreddy777]

I have one log file at particular path on server1. I am forwarding it to splunk index=index1.
I have another log file on server2, whose path and name of file is same as that of log file on server1. I am forwarding it to same index=index=1.

But I can see only the log file ingested from server1 but not from server 2.

As per CRC check it will check first 256 bytes. But this check is at forwarder level or the indexer level.
If it is at forwarder level, why it is not picking the same log on different server/forwarder.
If it is at indexer level, how to handle this kind of situation to ingest logs on different servers with same name, path and same first 256 bytes. Here I cannot use crcSalt as my logs are rotating.

[woodcock]

The CRC check is at a forwarder level (more accurately, at a splunk-instance level, since you can run more than one splunk instance on a forwarder). Start with splunk list monitor and them move to btool to check your configurations if it does not show up as an input.