I have to monitor all files inside one directory. But the tiny sized files are not getting into Splunk while all other files are duly getting indexed. i used CRCSalt parameters and Below is my config settings for inputs file.
[monitor://L:\XYZ.2.0\XYZlogs\*] disabled = false index = app_XYZ sourcetype = _json crcSalt = Source in greater than and less than sign initCrcLength = 256
Please tell us what am I missing out on.
Did you ever resolve your problem? I am experiencing the same issue with very small files ( < 2KB ) that Splunk forwarder is missing/skipping. Sometimes, I can delete and re-create the log file and Splunk will pick it up but sometimes nothing will trigger the forwarder to send the file to the indexers.
DId you ever resolve this issue? I am experiencing issues where Splunk forwarder sometimes misses very small ~2KB files.
You have the setting wrong. Use this exactly (do NOT change anything at all):
Yes its indeed the same settings.
crcSalt=SOURCE with angular brackets
Do you LITERALLY have this:
Or have you substituted the word
SOURCE for something else like this:
YOU MUST NOT DO THE LATTER! YOU MUST DO THE FORMER!
Yes i have done the former setting only.
Then it should work. Deploy to forwarders and restart splunk.
Are the files smaller than the 256 bytes?
File size is like 1-5KBs.
Also i just discovered that few of the data is going into "lastchanceindex". Why is that the case.
make sure the path is correct, try giving complete file name.
Yes path is accurate given other large files are duly getting indexed in splunk.