Getting Data In

crcSalt noob questions

StevenClarke
New Member

I'm going to tie a few questions into 1 as they all relate to crcSalt!

  1. The doco says "copy stanza from default to local".
    My problem is that with a GUI built forwarder reading a windows folder and sub folders - I can't see a specific monitor stanza that I am editing.
    Do I
    a: Just put a stanza [MONITOR] into the local inputs.conf with the crcSalt= line in it and hope it works?
    b: Try to find out what the actual [MONITOR] stanza should be and re-create that in the local inputs.conf?

  2. The same file system includes logs that role over - how do I make sure that the crcSalt implementation doesn't force re-reading of those files? I understand that "source" will force resalting of every file - how do I make it:
    a: Salt the files I want; and
    b: not Salt rolling log files?

Thanks in advance

Steve

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

hi StevenClarke

why do you want to use crcSalt? usually one just set it up if there are problems for example with 'file to small' messages.

cheers,
MuS

0 Karma

StevenClarke
New Member

That's just it MuS - I'm getting the file too small errors and more importantly similar config files in subdirectories not being indexed due crc error (looks the same).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...