Getting Data In

Monitor input not reading files ?

szabados
Communicator

I'm facing an issue with a monitor input like this:
index=myindex
disabled=0
sourcetype=mysourcetype
crcSalt=salt

The problem is, it only reads the first file in that folder. I've tried several times changing the crcSalt, and re-read the folder, the first file gets read every time ,but just the first, nothing else. I've tried adding different files to the folder, and removed the original ones, but the issue still persists. In the log, I see lines like these for the other files:
ERROR TailingProcessor - File will not be read, seekptr checksum did not match
Last time we saw this initcrc, filename was different.

Tags (3)
0 Karma

woodcock
Esteemed Legend

By setting crcSalt to the hardcoded value salt, you are telling Splunk to only index the very first file that matches the input stanza. This is because all files will have the same value "salt". Remove this line entirely (or switch to crcSalt =) and it will work fine.

0 Karma

badrinath_itrs
Communicator

Hi ,

Please take a look into below answer . You might need to set it to crcSalt = source depending on the content you have in the log files.

crcSalt = <SOURCE>

https://answers.splunk.com/answers/7457/error-tailingprocessor-unable-to-index-file.html

Regards,
Badri

badrinath_itrs
Communicator

Can you run below command to see what is being monitored.

$SPLUNK_HOME/bin/splunk list monitor

0 Karma

szabados
Communicator

I checked this already, and my monitor input is being shown here as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...