Splunk Enterprise Security

crcSalt is not working with multiple sub dir contains same file name monitoring

vemurisurya
Path Finder

Hi, Am writing a monitoring stanza to on-board the files with same name but different sub-directory named using following monitoring stanzas , but any time am getting only one host data other one is not coming in any more, host_segment = 4.

my directory structure

/var/syslog/Pal/H2-Panorama/file<date>.log
/var/syslog/Pal/H1-PA5220-02.PGR.com/file<date>.log
/var/syslog/Pal/H2-PA5220-01.PGR.com/file<date>.log
/var/syslog/Pal/H1-PA5220.PGR.com/file<date>.log
/var/syslog/Pal/H1-Pano.PGR.com/file<date>.log

inputs.conf

 [monitor:///var/syslog/Pal/.../*.log]
 blacklist = \.gz|\.tgz index=pan
 host_segment = 4 ignoreOlderThan = 1d
 disabled = 0 crcSalt = <string>

Props.conf

[source::...Pal...]
TRANSFORMS-assignSourcetype = pan_system, pan_traffic

TRANSFORMS.conf

[ pan_traffic ]
REGEX =^[^\,]+\,[^\,]+\,[^\,]+\,TRAFFIC\,..*
FORMAT = sourcetype::pan:traffic
DEST_KEY = MetaData:Sourcetype 
0 Karma

skalliger
Motivator

If you're setting crcSalt = <string> you might want to use crcSalt = <SOURCE> instead. You just copied it from the spec file. 🙂

Skalli

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...