Getting Data In

Why is my XML file in a monitored directory not being indexed?



I am monitoring a directory which contains some xml file.
Suppose there is a file 1.xml exists in directory. Now I put another file 2.xml which contains almost similar data, but there is some change in the few lines at the end of the file .
Size of both files is the same.
changes exists in last 256 bytes.
Initial 256 bytes are same.

As per my knowledge

The monitoring processor picks up new files and reads the first and last 256 bytes of the file. This data is hashed into a begin and end cyclic redundancy check (CRC).
The begin CRC is matched against a database that contains all the CRCs of files Splunk has seen before, but the end CRC does not match. This means that Splunk has previously read the file but that some of the material that it read has since changed. In this case, Splunk must re-read the whole file.  

But my file is not indexed.
Why is this happening?




i don't know where you got this info from, but as far as i know, splunk only checks the first 256 bytes of a file and not the last.

See here :

You shpuld adjust the crcSalt or initCrcLength for the corresponding input.

Four more information take a look into the admin manual for the inputs.conf:



0 Karma


What is role of seekCRC ?
It doesn't mean that it is hash value of last 256 bytes of file.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...