Getting Data In

Does crcSalt cause monitoring stanzas to only consider one "backup" file name?

sureshkumaar
Path Finder

Hi All,

        Having these 2 monitor stanze in one inputs.conf, but able to get data only for latest one monitor stanza.

        In both the file names strings are similar but numbers are changing

        Is that because of the crcSalt, it's considering only one "Backup*" file name?

        Also do the sourcetype needs to be different incase if we are adding "Backup*" in monitor stanza?

File name for first stanza  - BackupJobSummaryReport_3696_6883300_1588_1678235411

File name for second stanza  - BackupJobSummaryReport_19068_455837_9176_1678233614

[monitor://\\A11FLSCOMMVAULT\commvault_reports\Final_Report\Backup*]
index = backup
disabled = 0
sourcetype = commvault
crcSalt = <SOURCE>


[monitor://\\A11FLSCOMMVAULT\commvault_reports\LISTAPAC\Backup*]
disabled = 0
index = backup
sourcetype = commvault
crcSalt = <SOURCE>

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sureshkumaar,

monitor inputs are case-sensitive. Is it possible directory or filenames are not the same as \\A11FLSCOMMVAULT\commvault_reports\LISTAPAC\Backup* ?

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

See what

splunk list monitor

and

splunk list inputstatus

say. If they don't list your files, there's something wrong with settings because your files don't match. If the file is matched but not read due to some reason (too old, not considered as changed and so on), you should see that.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sureshkumaar,

if you have different file names you should read both the files.

Only one question: have your files an extension (e.g. ".log")?

In linux this path is correct, but in Windows you have to add ".*" at the end.

then, the double backslash at the beginning of "A11FLSCOMMVAULT" means that this is a nework path?

if not you havev to add also "c:".

ciao.

Giuseppe

0 Karma

sureshkumaar
Path Finder

Hi @gcusello  

Yes file names are different, as i mentioned earlier strings will remain as it is and the numbers will keep changing.

But able to get only data from one stanza, the other stanza not forwarding data.

I created separate app and tested by creating a file and added input to the file manually and able to get the data.

Having in same app wasn't working, is that because of same sourcetype using for 2 different sources in the inputs.conf???

the extension is "*.csv"

yes it's the network path works from the windows server

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sureshkumaar,

non you don't need to use two different sourcetype, you could also use one monitor stanza for both the inputs.

I'd add also the extention to the path:

[monitor://\\A11FLSCOMMVAULT\commvault_reports\*\Backup*.csv]
index = backup
disabled = 0
sourcetype = commvault
crcSalt = <SOURCE>

Anyway, the crcSalt is useful if you have the same content in more than one file, if the contetnts are different, youdon't need to use it: please try also without crcSalt.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...