Getting Data In

csv files are not getting indexed

karthikTIL
Path Finder

hi,
I have lot of csv files under a directory "/opt/splunk/splunkdata/June2014". when i ask splunk to index complete directory, it does not show many files in "search". is it because most of my files have same contents ? How do i make splunk ignore this? fyi., my file names are different.
should i modify crcSalt under "/opt/splunk/etc/system/default" ?if so, to what value?

Tags (2)
0 Karma

karthikTIL
Path Finder

HI,

i was able to solve this problem. there were many input.conf files in different directories as mentioned below and i included crcSalt= in all these files and restarted splunk and it worked.

/opt/splunk/etc/apps/launcher/local/inputs.conf
/opt/splunk/etc/system/local/inputs.conf
/opt/splunk/etc/system/default/inputs.conf

0 Karma

amitkr0201
Explorer

/opt/splunk/etc/system/default/inputs.conf

Any customization to this file might be overwritten if splunk is upgraded.

Better stick changes in

/opt/splunk/etc/system/local/inputs.conf only

0 Karma

karthikTIL
Path Finder

HI Amit,

inputs.conf under "/opt/splunk/etc/system/default" is already having "crcSalt = " in two places. Do i need to replace source inside angled bracket with the directory of my csv files "opt/splunk/splunkdata/June2014" which is my source?I did and restarted splunk but it did not help. please let me know.
Snippet of inputs.conf file is below

[batch://$SPLUNK_HOME/var/spool/splunk]
move_policy = sinkhole
crcSalt =

[batch://$SPLUNK_HOME/var/spool/splunk/...stash_new]
queue = stashparsing
sourcetype = stash_new
move_policy = sinkhole
crcSalt =

0 Karma

amitkr0201
Explorer
crcSalt = <SOURCE>  

should help you.
More about that here

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...