Getting Data In

crcSalt noob questions

StevenClarke
New Member

I'm going to tie a few questions into 1 as they all relate to crcSalt!

  1. The doco says "copy stanza from default to local".
    My problem is that with a GUI built forwarder reading a windows folder and sub folders - I can't see a specific monitor stanza that I am editing.
    Do I
    a: Just put a stanza [MONITOR] into the local inputs.conf with the crcSalt= line in it and hope it works?
    b: Try to find out what the actual [MONITOR] stanza should be and re-create that in the local inputs.conf?

  2. The same file system includes logs that role over - how do I make sure that the crcSalt implementation doesn't force re-reading of those files? I understand that "source" will force resalting of every file - how do I make it:
    a: Salt the files I want; and
    b: not Salt rolling log files?

Thanks in advance

Steve

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

hi StevenClarke

why do you want to use crcSalt? usually one just set it up if there are problems for example with 'file to small' messages.

cheers,
MuS

0 Karma

StevenClarke
New Member

That's just it MuS - I'm getting the file too small errors and more importantly similar config files in subdirectories not being indexed due crc error (looks the same).

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...