Hi, we are currently testing a Palo Alto app sec firewall and are sending some test logs over to the central indexer in CSV format. Can splunk read CSV files?
The splunkd.log file is giving me somewhat of an error stating the following:
05-25-2010 14:21:33.678 ERROR TailingProcessor - Ignoring path due to: File will not be read, is too small to match seekptr checksum (file=PATHTOMYFILES). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or contact Splunk Support for more info.
Let me know. Thanks!
Doesn't look like it worked. Here is my stanza:
disabled = false
host_segment = 3
index = myindex
sourcetype = mysourcetype
crcSalt = /pathtomyfiles
Is this correct syntax? not seeing the error message anymore but it still doesn't look like the files are being indexed.
Also, keep in mind that anytime you change
crcSalt you are likely to re-index all your files. You should also be aware that setting
crcSalt = <SOURCE> means that if you rotate your log files they may be indexed again. Normally splunk detects and handles this automatically, but using
<SOURCE> will effectively disable this feature. So you may need to update your rotation scheme to move log files to a different folder, or make sure your
monitor is only looking at your non-rotated files. Just a heads up.