Getting Data In

Splunk monitor mode query

Mansi24
Path Finder

i have indexed data from a directory in monitor mode ,and while checking the status of files being indexed i found an error " ignored file (crc conflict, needs crcSalt)" in the filestatus.
what does this error signifies and how to rectify it?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

For every file, splunk creates a CRC (cyclic redundancy check) handler, which is based on first few line of the file. This helps prevent re-indexing of same file (even though its renamed, especially in case of files which are getting rolled over). It seems that the files being ignored by Splunk, in your case ,have similar first few lines (characters) causing Splunk to ignore them.

To make Splunk read all the files in a directory regardless of similar files, you need to add "crcSalt = " in your input.conf stanza for the directory being monitored.

[monitor://C:\MyDirectory\*.log]
disabled = false
followTail = 0
sourcetype = myindex
crcSalt = <SOURCE>

Beware that, with this setting Splunk will index all the files, even though they have been renamed, rolled over.

View solution in original post

somesoni2
Revered Legend

For every file, splunk creates a CRC (cyclic redundancy check) handler, which is based on first few line of the file. This helps prevent re-indexing of same file (even though its renamed, especially in case of files which are getting rolled over). It seems that the files being ignored by Splunk, in your case ,have similar first few lines (characters) causing Splunk to ignore them.

To make Splunk read all the files in a directory regardless of similar files, you need to add "crcSalt = " in your input.conf stanza for the directory being monitored.

[monitor://C:\MyDirectory\*.log]
disabled = false
followTail = 0
sourcetype = myindex
crcSalt = <SOURCE>

Beware that, with this setting Splunk will index all the files, even though they have been renamed, rolled over.

somesoni2
Revered Legend

It has to be written as it is (string literal). And don't forget to either restart splunk instance or refresh configuration using "http://splunk-server:port/en-US/debug/refresh"

0 Karma

Mansi24
Path Finder

thanks somesoni2,

just to confirm that the written should be as it is or so we have to give the actual source from where the data is accessed for ex. if data source is my own system than i have to give my as .

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...