Getting Data In

ERROR TailingProcessor - File will not be read

mtamayo79
Engager

Hi,

I,am having problem with the configuration inputs.conf file, I'm monitoring remote computer with universal forwarder.

Remote host (monitoring):
Ditectory E:\SQL\Audit\Log
Files:Audit0001.log.......Audit0010.log
Log: ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=E:\SQL\Audit\Log\Audit0010.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

The splunk server, Inputs.conf:

[monitor://E:\SQL\Audit\Log]E:\SQL\Audit\Log]
crcSalt = <//E:\SQL\Audit\Log]E:\SQL\Audit\Log>

I try, but its not works

1 Solution

yannK
Splunk Employee
Splunk Employee

the exact use is actually the word <SOURCE>.

[monitor://E:\SQL\Audit\Log]
crcSalt = <SOURCE>

View solution in original post

MuS
SplunkTrust
SplunkTrust

use it like yannK wrote:

crcSalt = <SOURCE>

SOURCE is NO placeholder 😉

0 Karma

mtamayo79
Engager


[monitor://E:SQL_Audit_Log]
crcSalt = <>
</>

0 Karma

yannK
Splunk Employee
Splunk Employee

the exact use is actually the word <SOURCE>.

[monitor://E:\SQL\Audit\Log]
crcSalt = <SOURCE>

kristian_kolb
Ultra Champion

removed them. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...