I have about 8 files of the same kind of event logs which I require Splunk to index. Splunk managed to index 6 of them while the remaining 2 got the following error:
ERROR TailingProcessor - Ignoring path due to: File will not be read, seekptr checksum did not match (file=/myfile/test.out). Last time we saw this initcrc, the filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue">http://www.splunk.com/page/submit_issue for more info.
This is probably because the first 256 byte are the same on some in those files (to prevent Splunk from re-indexing a rotated file, ie same log file but different filename). To work around this, you can instruct Splunk to add the filename as a salt when computing the checksum to determine whether the content of a file has been processed. To do that you'll have to edit the inputs.conf where your file-monitor is configured and add the crcSalt = <SOURCE>
option.
Example:
[monitor://some/path]
sourcetype = some_sourcetype
crcSalt = <SOURCE>
The relevant inputs.conf is probably located in $SPLUNK_HOME/etc/system/local
or in one of the local folders in your apps $SPLUNK_HOME/etc/apps/someapp/local
.
Links:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Monitorfilesanddirectories http://www.splunk.com/base/Documentation/4.1.5/Admin/Inputsconf
This is probably because the first 256 byte are the same on some in those files (to prevent Splunk from re-indexing a rotated file, ie same log file but different filename). To work around this, you can instruct Splunk to add the filename as a salt when computing the checksum to determine whether the content of a file has been processed. To do that you'll have to edit the inputs.conf where your file-monitor is configured and add the crcSalt = <SOURCE>
option.
Example:
[monitor://some/path]
sourcetype = some_sourcetype
crcSalt = <SOURCE>
The relevant inputs.conf is probably located in $SPLUNK_HOME/etc/system/local
or in one of the local folders in your apps $SPLUNK_HOME/etc/apps/someapp/local
.
Links:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Monitorfilesanddirectories http://www.splunk.com/base/Documentation/4.1.5/Admin/Inputsconf