Getting Data In

Can splunk read logs in CSV format?

Contributor

Hi, we are currently testing a Palo Alto app sec firewall and are sending some test logs over to the central indexer in CSV format. Can splunk read CSV files?

The splunkd.log file is giving me somewhat of an error stating the following:

05-25-2010 14:21:33.678 ERROR TailingProcessor - Ignoring path due to: File will not be read, is too small to match seekptr checksum (file=PATHTOMYFILES). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or contact Splunk Support for more info.

Let me know. Thanks!

Brian

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

sure. please test if it works with

crcSalt = <SOURCE>

in the particular stanza of your app's inputs.conf

View solution in original post

Contributor

Doesn't look like it worked. Here is my stanza:

[monitor:///pathtomyfiles]
disabled = false
host =
host_segment = 3
index = myindex
sourcetype = mysourcetype
crcSalt = /pathtomyfiles

Is this correct syntax? not seeing the error message anymore but it still doesn't look like the files are being indexed.

Brian

0 Karma

Contributor

and Lowell since this was a test sample of csv logs the impact was not great but in the future I will definitely keep that in mind!!! Thanks again!!!

0 Karma

Contributor

sweet... that worked!!!!!!!!! Thanks GUYS!!!!!

0 Karma

Super Champion

Also, keep in mind that anytime you change crcSalt you are likely to re-index all your files. You should also be aware that setting crcSalt = <SOURCE> means that if you rotate your log files they may be indexed again. Normally splunk detects and handles this automatically, but using <SOURCE> will effectively disable this feature. So you may need to update your rotation scheme to move log files to a different folder, or make sure your monitor is only looking at your non-rotated files. Just a heads up.

Super Champion

No, you want the literal value "<SOURCE>". That is a special value with a special meaning. Take a look at http://www.splunk.com/base/Documentation/4.1.2/Admin/Inputsconf

Splunk Employee
Splunk Employee

sure. please test if it works with

crcSalt = <SOURCE>

in the particular stanza of your app's inputs.conf

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!