crcSalt question - index all

[renanprado96]

I already know that without crcSalt Splunk checks the first 256 characters, and the crcSalt = the Splunk checks the source.
But what I do for Splunk not check anything, index all files?

Thank you!!

[somesoni2]

IMP, the crcSalt= will do re-indexing of all files. Did you give that a try?

[renanprado96]

So I would never stop indexing?
The crcSalt has other parameters beyond the ?

[jkat54 · Accepted solution]

If you did that, it would never stop indexing all files... it wouldnt know what files it has read, and would just keep indexing again and again.

[renanprado96]

Got it,
In addition to the has more parameters for crc Salt?

Thanks...

[jkat54]

you can use crcSalt=RandomString but this will only make it reindex files that have already been indexed, and it will only index them one new time.

What are you trying to do?

Most people want to use crcSalt=<SOURCE> and use the "Monitor" stanzas in inputs.conf.

I guess if you wanted to, you could greatly reduce the size of your fishbucket aka btree:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

file_tracking_db_threshold_mb = 1

The above would cause there to be a very small fishbucket (which contains the CRCs), and so splunk would fill the fishbucket rapidly and then rotate the data within... effectively "forgetting" very quickly that it had indexed a file.

[renanprado96]

Got it, do not have much text about Salt crc, so I was confused.

It is possible to create a crc without being the first characters and not the source?
We're having trouble in this part.

Thank you, again.