Monitoring Splunk

Splunk Log ingestion issues

Prakash493
Communicator

Currently i am facing a issue , i am monitoring a directory that has over 14000 files i am getting few files are ingesting to splunk and few files are not ingesting , currently i am using these two stanzas in my input.conf file disabled = false
recursive = true , anyone has face similar issue ?

Tags (1)
0 Karma
1 Solution

koshyk
Super Champion

This could be related to multiple issues
1. crcSalt => By default, the Splunk only performs CRCs against the first few lines of a file. so if the lines are exactly same on these files for the default settings, it may NOT index
2. initCrcLength => default is 256 bytes ; How much of a file, in bytes, that the input reads before trying to
identify whether it is a file that has already been seen. You might want to adjust this if you have many files with common headers
3. Do a btool of inputs to see if your settings are overriden in some other app

you need to give the exact samples/btool output in the question for us to help you further

Good link to read about => https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf
and of course inputs.conf specification

View solution in original post

0 Karma

koshyk
Super Champion

This could be related to multiple issues
1. crcSalt => By default, the Splunk only performs CRCs against the first few lines of a file. so if the lines are exactly same on these files for the default settings, it may NOT index
2. initCrcLength => default is 256 bytes ; How much of a file, in bytes, that the input reads before trying to
identify whether it is a file that has already been seen. You might want to adjust this if you have many files with common headers
3. Do a btool of inputs to see if your settings are overriden in some other app

you need to give the exact samples/btool output in the question for us to help you further

Good link to read about => https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf
and of course inputs.conf specification

0 Karma

Prakash493
Communicator

so do i need to add crcSalt= or just crcSalt =>

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...