■ErrorMessages
01-20-2016 16:35:21.999 +0900 ERROR TailReader - File will not be read, seekptr checksum did not match (file=path\DhcpSrvLog-Wed.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
■inputs.conf
[monitor://path]
disabled = false
index = main
host = ***
sourcetype = DHCP
whitelist = DhcpSrvLog-Wed.log
crcSalt = TestDHCP
■props.conf
[DHCP]
CHARSET = SHIFT-JIS
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
You have crcSalt = TestDHCP
in your props.conf
I would remove the crcSalt setting entirely unless you are sure you need it (then restart splunk)
Alternatively, set it to
crcSalt = <SOURCE>
See the section labelled crcSalt at http://docs.splunk.com/Documentation/Splunk/6.3.2/Admin/Inputsconf