Getting Data In

crcSalt noob questions

StevenClarke
New Member

I'm going to tie a few questions into 1 as they all relate to crcSalt!

  1. The doco says "copy stanza from default to local".
    My problem is that with a GUI built forwarder reading a windows folder and sub folders - I can't see a specific monitor stanza that I am editing.
    Do I
    a: Just put a stanza [MONITOR] into the local inputs.conf with the crcSalt= line in it and hope it works?
    b: Try to find out what the actual [MONITOR] stanza should be and re-create that in the local inputs.conf?

  2. The same file system includes logs that role over - how do I make sure that the crcSalt implementation doesn't force re-reading of those files? I understand that "source" will force resalting of every file - how do I make it:
    a: Salt the files I want; and
    b: not Salt rolling log files?

Thanks in advance

Steve

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

hi StevenClarke

why do you want to use crcSalt? usually one just set it up if there are problems for example with 'file to small' messages.

cheers,
MuS

0 Karma

StevenClarke
New Member

That's just it MuS - I'm getting the file too small errors and more importantly similar config files in subdirectories not being indexed due crc error (looks the same).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...