Getting Data In

crcSalt question - index all

Path Finder

I already know that without crcSalt Splunk checks the first 256 characters, and the crcSalt = the Splunk checks the source.
But what I do for Splunk not check anything, index all files?

Thank you!!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

If you did that, it would never stop indexing all files... it wouldnt know what files it has read, and would just keep indexing again and again.

View solution in original post

SplunkTrust
SplunkTrust

IMP, the crcSalt= will do re-indexing of all files. Did you give that a try?

0 Karma

Path Finder

So I would never stop indexing?
The crcSalt has other parameters beyond the ?

0 Karma

SplunkTrust
SplunkTrust

If you did that, it would never stop indexing all files... it wouldnt know what files it has read, and would just keep indexing again and again.

View solution in original post

Path Finder

Got it,
In addition to the has more parameters for crc Salt?

Thanks...

0 Karma

SplunkTrust
SplunkTrust

you can use crcSalt=RandomString but this will only make it reindex files that have already been indexed, and it will only index them one new time.

What are you trying to do?

Most people want to use crcSalt=<SOURCE> and use the "Monitor" stanzas in inputs.conf.

I guess if you wanted to, you could greatly reduce the size of your fishbucket aka btree:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

filetrackingdbthresholdmb = 1

The above would cause there to be a very small fishbucket (which contains the CRCs), and so splunk would fill the fishbucket rapidly and then rotate the data within... effectively "forgetting" very quickly that it had indexed a file.

0 Karma

Path Finder

Got it, do not have much text about Salt crc, so I was confused.

It is possible to create a crc without being the first characters and not the source?
We're having trouble in this part.

Thank you, again.

0 Karma