Getting Data In

ERROR TailingProcessor - File will not be read

Engager

Hi,

I,am having problem with the configuration inputs.conf file, I'm monitoring remote computer with universal forwarder.

Remote host (monitoring):
Ditectory E:\SQL\Audit\Log
Files:Audit0001.log.......Audit0010.log
Log: ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=E:\SQL\Audit\Log\Audit0010.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

The splunk server, Inputs.conf:

[monitor://E:\SQL\Audit\Log]E:\SQL\Audit\Log]
crcSalt = <//E:\SQL\Audit\Log]E:\SQL\Audit\Log>

I try, but its not works

1 Solution

Splunk Employee
Splunk Employee

the exact use is actually the word <SOURCE>.

[monitor://E:\SQL\Audit\Log]
crcSalt = <SOURCE>

View solution in original post

SplunkTrust
SplunkTrust

use it like yannK wrote:

crcSalt = <SOURCE>

SOURCE is NO placeholder 😉

0 Karma

Engager


[monitor://E:SQL_Audit_Log]
crcSalt = <>
</>

0 Karma

Splunk Employee
Splunk Employee

the exact use is actually the word <SOURCE>.

[monitor://E:\SQL\Audit\Log]
crcSalt = <SOURCE>

View solution in original post

Ultra Champion

removed them. 🙂

0 Karma