ERROR TailingProcessor - Ignoring path

[remy06]

I have about 8 files of the same kind of event logs which I require Splunk to index. Splunk managed to index 6 of them while the remaining 2 got the following error:

ERROR TailingProcessor - Ignoring path due to: File will not be read, seekptr checksum did not match (file=/myfile/test.out). Last time we saw this initcrc, the filename was different.  You may wish to use a CRC salt on this source.  Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue">http://www.splunk.com/page/submit_issue for more info.

[ziegfried · Accepted solution]

This is probably because the first 256 byte are the same on some in those files (to prevent Splunk from re-indexing a rotated file, ie same log file but different filename). To work around this, you can instruct Splunk to add the filename as a salt when computing the checksum to determine whether the content of a file has been processed. To do that you'll have to edit the inputs.conf where your file-monitor is configured and add the crcSalt = <SOURCE> option.

Example:

[monitor://some/path]
sourcetype = some_sourcetype
crcSalt = <SOURCE>

The relevant inputs.conf is probably located in $SPLUNK_HOME/etc/system/local or in one of the local folders in your apps $SPLUNK_HOME/etc/apps/someapp/local.

Links:

http://www.splunk.com/base/Documentation/4.1.5/Admin/Monitorfilesanddirectories http://www.splunk.com/base/Documentation/4.1.5/Admin/Inputsconf