I'm facing an issue with a monitor input like this:
The problem is, it only reads the first file in that folder. I've tried several times changing the crcSalt, and re-read the folder, the first file gets read every time ,but just the first, nothing else. I've tried adding different files to the folder, and removed the original ones, but the issue still persists. In the log, I see lines like these for the other files:
ERROR TailingProcessor - File will not be read, seekptr checksum did not match
Last time we saw this initcrc, filename was different.
crcSalt to the hardcoded value
salt, you are telling Splunk to only index the very first file that matches the input stanza. This is because all files will have the same value "salt". Remove this line entirely (or switch to
crcSalt =) and it will work fine.
Please take a look into below answer . You might need to set it to
crcSalt = source depending on the content you have in the log files.
crcSalt = <SOURCE>