Splunk not picking up all the files from the folder it is Monitoring

[raja21]

I am using Splunk 7.0.1, Trial Version.

I have a folder that consists of JSON records.
These JSON records are created by a Python script by parsing a log file.

On keeping that folder to monitor in Splunk i see that Splunk is not indexing all the files.
Lets say if i have 2 lakh files then Splunk has only indexed 1 lakh files.

Each JSON record is of 4-5 Kb.
And the content of each JSON record is different.

I also checked that the daily usage policy of 500 Mb is not crossed.

I don't know where i'm going wrong.
Please help me.

[hortonew]

Investigate splunkd.log on the forwarder collecting the files for tailingprocessor messages. Also, if each JSON record has the same header (first 256b) then it's possible splunk thinks they're the same file and it's skipping some. In inputs.conf, you can control initCrcLength and crcSalt. Try setting crcSalt=<SOURCE> which will let splunk index files with the same CRC value.

[raja21]

Hi @hortonew i edited my inputs.cong and added crcSalt = < S O U R C E >
Still it is not picking up all the JSON records in the folder.

P.s I added in the extra spaces as it was not posting it

[trenin]

Did you ever solve your problem? I think I am having the same problem.