Getting Data In

Splunk, monitor file changes and MD5 checksum


Hi all,

I'm trying to index a log file which consists of some counters. This file doesn't change a lot as counters are just incremented.

As the file size is around 1kB , I have tried to use CHECK_METHOD=entire_md5 to avoid the 256 first bytes and 256 last bytes problem. But the monitor doesn't work so well...

I'm suspecting Splunk to keep hash results somewhere , because my universal forwarder doesn't want to send the log content if the log file has already have the same content.

Maybe anyone can explain the monitor MD5 stuff more deeply? The best solution for me would be to tell Splunk to not keep those hashes.

Thank you.



You most likely need to add crcSalt = <SOURCE> to your input definition. See more info in these questions/answers:

0 Karma


Hello Ayn,

Nice try but the file name never changes so the crcSalt is not useful. Splunk continues to retain the previous hashes.

Another idea maybe?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...