Getting Data In
Highlighted

How to get Splunk to index a small 1.5KB CSV file?

Contributor

I am trying to make Splunk read/index a CSV that is of 1.5KB.

I have used the traditional CRCSALT=>SOURCE> tag in the inputs.conf, however, that does not seem to work.

Any ideas, how i can make the file read? It is a once a week feed and it does not process the files.

Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

SplunkTrust
SplunkTrust

Should be crcSalt=<SOURCE> capitalization / case sensitivity matters.

Also i think its a typo but there should be a less than sign on left side of SOURCE and greater than sign on right side.

0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

Contributor

Yes. It is a typo. That is what happens when you break your head against such unforeseen issues.

And thus the capslock was ON.

But this did not work. 😞

0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

SplunkTrust
SplunkTrust

Can you post the csv file somewhere like pastebin.com?

If its 1.5KB that means its ~ 1500B which means it has well over 256 characters if in ASCII because each ASCII character = 1Byte on disk. So there's enough data to form a proper CRC salt.

Also if you could provide the inputs.conf and props.conf stanzas for the data source maybe there is a config issue there.

0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

Contributor

@jkat54

Sorry to get back to you on this after a long time.

Inputs.conf :
[monitor:///Data/scripts/email_listener/logs/username/usernames*.csv]
sourcetype = username
source = username
host = username
index = main
crcSalt=

THere is no props.conf created.

Also assume the CSV contains numbers in one single column. Contains random numbers for around 132 rows.

0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

SplunkTrust
SplunkTrust

put the 'code' in codeblocks. Highlight it and click the 101010 button.

This will make

 crcSalt=<SOURCE> 

show up

0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

Contributor

I am unable to use the crcSalt = [] in the comment box. It is getting invisible.

0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

Contributor
[monitor:///Data/scripts/email_listener/logs/username/usernames*.csv]

sourcetype = username
source = username
host = username
index = main
crcSalt = <SOURCE>
0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

SplunkTrust
SplunkTrust

Are you using batch OR monitor in inputs.conf?

0 Karma
Highlighted

Re: How to get Splunk to index a small 1.5KB CSV file?

Contributor
[monitor:///Data/scripts/email_listener/logs/username/usernames*.csv]

sourcetype = username
source = username
host = username
index = main
crcSalt = <SOURCE>
0 Karma