Getting Data In

text files being ignored

New Member

We have below monitor stanza in inputs.conf file
[monitor:///usr/sap/IXD/SYS/profile]

disabled = false

index = erp

crcSalt = SOURCE

This profile folder contains 3 important text files DEFAULT.PFL, IXD_DVEBMGS17_spwdfvml0248, START_DVEBMGS17_spwdfvml0248
which we want splunk to monitor. But its monitoring only DEFAULT.PFL file, when searched in indexer its not giving any results, Tried with all wild character search but no use.
Please advice how to solve this issue, this is very critical for us as these files are very important to be monitores in all our several servers.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

What _d_ mentioned looks good and I would say that you might want to double check the path and permissions for the files to be monitored as well as the access rights for the Splunk user when running your search, including making sure that the Splunk user has access to the index you are sending these events to.

So using:

[monitor:///usr/sap/IXD/SYS/profile] 
disabled = false 
index = erp 
crcSalt = <SOURCE>

Followed by making sure that when you search that you specify

search index="erp" *

Should be fine as long as all the requirements are met for monitoring all the files. One last thing to consider. Is there any sort of file lock that might be on those files that would prevent Splunk from opening them to index?

Influencer

Are the file permissions correct?

0 Karma

New Member

Hi,
Can anyone please help to resolve this issue.

0 Karma

New Member

yes, file permissions are correct

0 Karma

Splunk Employee
Splunk Employee

Try the stanza below:

[monitor:///usr/sap/IXD/SYS/profile]
disabled = false
index = erp
crcSalt = <SOURCE>

Notice that when the literal string <SOURCE> (including the angle brackets) is added, the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

0 Karma

New Member

Thanks for your update, but it is not working:(

0 Karma

New Member

Also in somefile.out file from other host I see below log


/usr/sap/IX4/SYS/profile/s:key
ignored file (crc conflict, needs crcSalt)/s:key

From above log it should not show this file when searched, but when I searched for this file it gives me results for this file and I can see the file has indexed, which should not have happened I guess..its very strange!
Please help to resolve the above 2 issues.
Thanks in advance!

0 Karma