Getting Data In

crcSalt noob questions

StevenClarke
New Member

I'm going to tie a few questions into 1 as they all relate to crcSalt!

  1. The doco says "copy stanza from default to local".
    My problem is that with a GUI built forwarder reading a windows folder and sub folders - I can't see a specific monitor stanza that I am editing.
    Do I
    a: Just put a stanza [MONITOR] into the local inputs.conf with the crcSalt= line in it and hope it works?
    b: Try to find out what the actual [MONITOR] stanza should be and re-create that in the local inputs.conf?

  2. The same file system includes logs that role over - how do I make sure that the crcSalt implementation doesn't force re-reading of those files? I understand that "source" will force resalting of every file - how do I make it:
    a: Salt the files I want; and
    b: not Salt rolling log files?

Thanks in advance

Steve

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

hi StevenClarke

why do you want to use crcSalt? usually one just set it up if there are problems for example with 'file to small' messages.

cheers,
MuS

0 Karma

StevenClarke
New Member

That's just it MuS - I'm getting the file too small errors and more importantly similar config files in subdirectories not being indexed due crc error (looks the same).

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...