Getting Data In

crcSalt noob questions

StevenClarke
New Member

I'm going to tie a few questions into 1 as they all relate to crcSalt!

  1. The doco says "copy stanza from default to local".
    My problem is that with a GUI built forwarder reading a windows folder and sub folders - I can't see a specific monitor stanza that I am editing.
    Do I
    a: Just put a stanza [MONITOR] into the local inputs.conf with the crcSalt= line in it and hope it works?
    b: Try to find out what the actual [MONITOR] stanza should be and re-create that in the local inputs.conf?

  2. The same file system includes logs that role over - how do I make sure that the crcSalt implementation doesn't force re-reading of those files? I understand that "source" will force resalting of every file - how do I make it:
    a: Salt the files I want; and
    b: not Salt rolling log files?

Thanks in advance

Steve

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

hi StevenClarke

why do you want to use crcSalt? usually one just set it up if there are problems for example with 'file to small' messages.

cheers,
MuS

0 Karma

StevenClarke
New Member

That's just it MuS - I'm getting the file too small errors and more importantly similar config files in subdirectories not being indexed due crc error (looks the same).

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...