Splunk Enterprise Security

crcSalt is not working with multiple sub dir contains same file name monitoring

vemurisurya
Path Finder

Hi, Am writing a monitoring stanza to on-board the files with same name but different sub-directory named using following monitoring stanzas , but any time am getting only one host data other one is not coming in any more, host_segment = 4.

my directory structure

/var/syslog/Pal/H2-Panorama/file<date>.log
/var/syslog/Pal/H1-PA5220-02.PGR.com/file<date>.log
/var/syslog/Pal/H2-PA5220-01.PGR.com/file<date>.log
/var/syslog/Pal/H1-PA5220.PGR.com/file<date>.log
/var/syslog/Pal/H1-Pano.PGR.com/file<date>.log

inputs.conf

 [monitor:///var/syslog/Pal/.../*.log]
 blacklist = \.gz|\.tgz index=pan
 host_segment = 4 ignoreOlderThan = 1d
 disabled = 0 crcSalt = <string>

Props.conf

[source::...Pal...]
TRANSFORMS-assignSourcetype = pan_system, pan_traffic

TRANSFORMS.conf

[ pan_traffic ]
REGEX =^[^\,]+\,[^\,]+\,[^\,]+\,TRAFFIC\,..*
FORMAT = sourcetype::pan:traffic
DEST_KEY = MetaData:Sourcetype 
0 Karma

skalliger
Motivator

If you're setting crcSalt = <string> you might want to use crcSalt = <SOURCE> instead. You just copied it from the spec file. 🙂

Skalli

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...