Monitor input not reading files ?

[szabados]

I'm facing an issue with a monitor input like this:
index=myindex
disabled=0
sourcetype=mysourcetype
crcSalt=salt

The problem is, it only reads the first file in that folder. I've tried several times changing the crcSalt, and re-read the folder, the first file gets read every time ,but just the first, nothing else. I've tried adding different files to the folder, and removed the original ones, but the issue still persists. In the log, I see lines like these for the other files:
ERROR TailingProcessor - File will not be read, seekptr checksum did not match
Last time we saw this initcrc, filename was different.

[woodcock]

By setting crcSalt to the hardcoded value salt, you are telling Splunk to only index the very first file that matches the input stanza. This is because all files will have the same value "salt". Remove this line entirely (or switch to crcSalt =) and it will work fine.

[badrinath_itrs]

Hi ,

Please take a look into below answer . You might need to set it to crcSalt = source depending on the content you have in the log files.

crcSalt = <SOURCE>

https://answers.splunk.com/answers/7457/error-tailingprocessor-unable-to-index-file.html

Regards,
Badri

[badrinath_itrs]

Can you run below command to see what is being monitored.

$SPLUNK_HOME/bin/splunk list monitor

[szabados]

I checked this already, and my monitor input is being shown here as well.