Getting Data In

I'm getting an error for some files I am monitoring about hitting EOF while computing CRC. What does this mean?

the_wolverine
Champion

I'm seeing the following errors in splunkd.log and my file isn't being monitored properly -- the events don't seem to be coming in anymore!

FileInputTracker - Stored seekPtr longer than file: /opt/IBM/WebSphere/AppServer/myServer/SystemOut.log.
FileInputTracker - Read a similar file to this that was longer. Perhaps you have two files that have the same content.
FileInputTracker - Hit EOF while computing CRC: 0/256.
FileInputTracker - Couldn't get CRC for file: /opt/IBM/WebSphere/AppServer/myServer/SystemOut.log

What could be the issue?

1 Solution

the_wolverine
Champion

This means that Splunk cannot get a correct read on the file to calculate the CRC. Or, the file may be the same as another file. To workaround, add the following setting to the appropriate monitor stanza in $SPLUNK_HOME/etc/system/local/inputs.conf: crcSalt = <SOURCE>

For example:

[monitor:///opt/IBM/WebSphere/AppServer/myServer/SystemOut.log]
crcSalt = <SOURCE>

*NOTE: the example above is literal/verbatim. You will need to enter it exactly as specified in the example above including exact case/capitalization.

View solution in original post

0 Karma

shirolu
Explorer

CrcSalt = I set the parameters in the input.conf

I have the right information into the index

But the data

The emergence of many duplicate information

How do I remove the duplicate information to

CT

0 Karma

jrodman
Splunk Employee
Splunk Employee

The "simialr file to this that was longer" message typically means you've got files with headers, so more than one looks the same, and when the log rolls, splunk is a bit unsure what the story is.

The "hit EOF while computing CRC: 0/256" means that, as you say, we failed to grab a CRC from the file, which could be because it's too short (under 256 bytes), or sometimes it can indicate weird read errors that splunk didn't expect.

If you're seeing these within milliseconds of each other, you may want to take a closer look at what's going on with the files before taking action.

0 Karma

the_wolverine
Champion

This means that Splunk cannot get a correct read on the file to calculate the CRC. Or, the file may be the same as another file. To workaround, add the following setting to the appropriate monitor stanza in $SPLUNK_HOME/etc/system/local/inputs.conf: crcSalt = <SOURCE>

For example:

[monitor:///opt/IBM/WebSphere/AppServer/myServer/SystemOut.log]
crcSalt = <SOURCE>

*NOTE: the example above is literal/verbatim. You will need to enter it exactly as specified in the example above including exact case/capitalization.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...