Logs were not indexing in Splunk from a particular path

[pavanae]

The logs from the source="/tpo/jboss/server/shared/logs/*cap/server.log" were not properly getting into the index and i continuously seeing the following logs in the splunkd.log everyday at 1 A.M

INFO WatchedFile - Will begin reading at offset=0 for file="/tpo/jboss/server/shared/logs/*cap/server.log"
INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file="/tpo/jboss/server/shared/logs/*cap/server.log"
INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file="/tpo/jboss/server/shared/logs/*cap/server.log"

Please do suggest what needs to be done to get those logs

[pavanae · Accepted solution]

This happened due to the permission issues on the particular paths in the forwarder. It got resolved after providing the required permissions for those paths.

[pavanae]

Missed the Following log to mention in the above question.

ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/tpo/jboss/server/shared/logs/*cap/server.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at

[somesoni2]

Above error means that the initcrc handler (default first 250 bytes of the file) which Splunk uses to identify a file that needs monitoring is not unique and it's not going to ingest the data.

How is the file generated and does it have a common header at the start which will be same for every file/copy of the file?