crcSalt = SOURCE not working as expected

[snickered]

On my universal forwarder inputs.conf I have: crcSalt = for C:\TEMP. When I add a file it's consumed and sent to my indexer. Then I remove the file from C:\TEMP, restart the universal forwarder and re-add the same file (with the same filename) to C:\TEMP. When I do, it's not consumed again. Isn't crcSalt supposed to allow this?

It seems like crcSalt is almost working because when I simply change the filename and add it to C:\TEMP the file is indexed again.

Am I mistaken? Shouldn't crcSalt = allow me to index the exact same file with the same filename more than once?

In my inputs.conf I have SOURCE capitalized. For some reason I can't capitalize in the question.

[Drainy · Accepted solution]

You're slightly misunderstanding the purpose of the crcSalt, all it does is add the file path to the salt used to generate the CRC... which if its the same name and same folder will be identical!

If you're looking to reindex a file thats already been indexed you need to clear out the fishbucket by running the following command from the forwarder $SPLUNK_HOME/bin

./splunk clean all

Beware though, this will make the forwarder reindex EVERYTHING its already read so be careful. Also it will reset the password to changeme if you had changed it.

[yannK]

for selective fishbucket cleaning, take a look at
http://splunk-base.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder/72564

[snickered]

Ah! Not sure how I missed that in the documentation. Thanks.