Getting Data In

text files being ignored

Rajshekhar
New Member

We have below monitor stanza in inputs.conf file
[monitor:///usr/sap/IXD/SYS/profile]

disabled = false

index = erp

crcSalt = SOURCE

This profile folder contains 3 important text files DEFAULT.PFL, IXD_DVEBMGS17_spwdfvml0248, START_DVEBMGS17_spwdfvml0248
which we want splunk to monitor. But its monitoring only DEFAULT.PFL file, when searched in indexer its not giving any results, Tried with all wild character search but no use.
Please advice how to solve this issue, this is very critical for us as these files are very important to be monitores in all our several servers.

Tags (2)
0 Karma

Rob
Splunk Employee
Splunk Employee

What _d_ mentioned looks good and I would say that you might want to double check the path and permissions for the files to be monitored as well as the access rights for the Splunk user when running your search, including making sure that the Splunk user has access to the index you are sending these events to.

So using:

[monitor:///usr/sap/IXD/SYS/profile] 
disabled = false 
index = erp 
crcSalt = <SOURCE>

Followed by making sure that when you search that you specify

search index="erp" *

Should be fine as long as all the requirements are met for monitoring all the files. One last thing to consider. Is there any sort of file lock that might be on those files that would prevent Splunk from opening them to index?

MHibbin
Influencer

Are the file permissions correct?

0 Karma

Rajshekhar
New Member

Hi,
Can anyone please help to resolve this issue.

0 Karma

Rajshekhar
New Member

yes, file permissions are correct

0 Karma

_d_
Splunk Employee
Splunk Employee

Try the stanza below:

[monitor:///usr/sap/IXD/SYS/profile]
disabled = false
index = erp
crcSalt = <SOURCE>

Notice that when the literal string <SOURCE> (including the angle brackets) is added, the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

0 Karma

Rajshekhar
New Member

Thanks for your update, but it is not working:(

0 Karma

Rajshekhar
New Member

Also in somefile.out file from other host I see below log


/usr/sap/IX4/SYS/profile/s:key
ignored file (crc conflict, needs crcSalt)/s:key

From above log it should not show this file when searched, but when I searched for this file it gives me results for this file and I can see the file has indexed, which should not have happened I guess..its very strange!
Please help to resolve the above 2 issues.
Thanks in advance!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...