ERROR TailingProcessor - File will not be read

[mtamayo79]

Hi,

I,am having problem with the configuration inputs.conf file, I'm monitoring remote computer with universal forwarder.

Remote host (monitoring):
Ditectory E:\SQL\Audit\Log
Files:Audit0001.log.......Audit0010.log
Log: ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=E:\SQL\Audit\Log\Audit0010.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

The splunk server, Inputs.conf:

[monitor://E:\SQL\Audit\Log]E:\SQL\Audit\Log]
crcSalt = <//E:\SQL\Audit\Log]E:\SQL\Audit\Log>

I try, but its not works

[MuS]

use it like yannK wrote:

crcSalt = <SOURCE>

SOURCE is NO placeholder 😉

[mtamayo79]

[monitor://E:SQL_Audit_Log]
crcSalt = <>
</>

[yannK · Accepted solution]

the exact use is actually the word <SOURCE>.

[monitor://E:\SQL\Audit\Log]
crcSalt = <SOURCE>

[kristian_kolb]

removed them. 🙂