I am trying to import data reading a file .But I keep getting the below error in internal logs
INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/usr/local/ios/var/logs/PN_Usage_iujj_Jun28.22.10.56.csv'
07-15-2022 11:37:42.256 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/usr/local/ios/var/logs/PN_Usage_iuhg_Jun28.22.16.16.csv'.
inputs
[monitor:///usr/local/ios/var/logs/PN_Usage_*.csv]
index = xyz
sourcetype=ios:pn:usage
#crcSalt = vmr
initCrcLength = 10000
props
[ios:pn:usage]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\"\d+\-\d+\-\d+\_\d+\:\d+
MAX_TIMESTAMP_LOOKAHEAD=17
NO_BINARY_CHECK=null
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true
TIME_FORMAT=%Y-%m-%d_%H:%M
TIME_PREFIX=\"
Sample events:
2022-07-14_15:35, PO@abc, InOctets, 4541070, OutOctets, 12763951, Total MB used, 2.163127625
2022-07-14_15:35, BE@abc, InOctets, 75945647, OutOctets, 650376983, Total MB used, 90.79032875
Is there any other settings I need to include or remove.
Thanks in Advance
Hi there,
Your inputs.conf setting of `initCrcLength = 10000` tells Splunk to read 10000 bytes into the file to validate the seekcrc or if this file was seen before. If your file is smaller than 10000 bytes Splunk will report the message you see and re-index the file. This behaviour is expected as described in the docs https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Inputsconf#MONITOR:
Try to remove the option `initCrcLength` and restart Splunk.
Hope this helps ...
cheers, MuS