Getting Data In

windows UF issues

crazyeva
Contributor

I installed a windows universal forwarder, to send some txt files to indexer.
those txt files are named with timestamp, say 20140707120100_xx.txt.
i'd like splunk to eat every newly generated txt file, nomatter if in 'default crclength' is the same content.
because a new file maybe just exactly the same with the last one, except a last line...

i found 'crcSalt = *.txt' does not work, and 'initCrcLength' will be too large a number to make effect.
What should i do to force splunk eat files with same and very very long head?

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can set this to make Splunk include the filename in the CRC calculation:

crcSalt = <SOURCE>

That's literally <SOURCE>, it'll substitute the filename itself in each case.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can set this to make Splunk include the filename in the CRC calculation:

crcSalt = <SOURCE>

That's literally <SOURCE>, it'll substitute the filename itself in each case.

crazyeva
Contributor

thank you, now at last i understand what '' means!
i am so stupid

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...