Monitoring Splunk

A part of the data in the monitored CSV file is missing.

JA8eginner
Explorer

Hello,

There is a problem that some of the data in the monitored CSV file is not included in the index.
For example, there are 120 rows in the index, but 130 rows in the CSV file.

When I upload the same CSV file on Splunk Web, it registers 130 correctly, so I don't think the file is corrupted.
I have checked the settings in the admin manual and other sources,
but I can't find a solution, so any help would be appreciated.

Note: In my environment, I have built a Splunk server in AWS and monitor CSV files stored in EBS.

[ props.conf ]

CHARSET = UTF-8
BREAK_ONLY_BEFORE_DATE =
DATETIME_CONFIG =
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = SpecifiedColumn
TIME_FORMAT = %Y/%m/%d
category = Structureds
description = Something
disabled = false
pulldown_type = true


Thank you.

Labels (1)
Tags (2)
0 Karma
1 Solution

JA8eginner
Explorer

I guessed that this problem was caused by not reading the CSV file data correctly, so I'll drop it.

View solution in original post

0 Karma

JA8eginner
Explorer

I guessed that this problem was caused by not reading the CSV file data correctly, so I'll drop it.

0 Karma

JA8eginner
Explorer

Hi @aasabatini ,
Thank you for your reply.
I'll try it on inputs.conf

0 Karma

aasabatini
Motivator

Hi @JA8eginner 

 

try to add this  on your props stanza

crcSalt = <SOURCE>

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...