Getting Data In

crcSalt question - index all

renanprado96
Path Finder

I already know that without crcSalt Splunk checks the first 256 characters, and the crcSalt = the Splunk checks the source.
But what I do for Splunk not check anything, index all files?

Thank you!!

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

If you did that, it would never stop indexing all files... it wouldnt know what files it has read, and would just keep indexing again and again.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

IMP, the crcSalt= will do re-indexing of all files. Did you give that a try?

0 Karma

renanprado96
Path Finder

So I would never stop indexing?
The crcSalt has other parameters beyond the ?

0 Karma

jkat54
SplunkTrust
SplunkTrust

If you did that, it would never stop indexing all files... it wouldnt know what files it has read, and would just keep indexing again and again.

renanprado96
Path Finder

Got it,
In addition to the has more parameters for crc Salt?

Thanks...

0 Karma

jkat54
SplunkTrust
SplunkTrust

you can use crcSalt=RandomString but this will only make it reindex files that have already been indexed, and it will only index them one new time.

What are you trying to do?

Most people want to use crcSalt=<SOURCE> and use the "Monitor" stanzas in inputs.conf.

I guess if you wanted to, you could greatly reduce the size of your fishbucket aka btree:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

file_tracking_db_threshold_mb = 1

The above would cause there to be a very small fishbucket (which contains the CRCs), and so splunk would fill the fishbucket rapidly and then rotate the data within... effectively "forgetting" very quickly that it had indexed a file.

0 Karma

renanprado96
Path Finder

Got it, do not have much text about Salt crc, so I was confused.

It is possible to create a crc without being the first characters and not the source?
We're having trouble in this part.

Thank you, again.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...