Splunk Enterprise

Why is data not indexed for data input?

mcohen13
Loves-to-Learn

I have index that suddenly stoped indexing data.

even after I entered crcSalt = <SOURCE> to the inputs.conf file data is not indexed anymore

the logs continue to show the following error:

"File will not be read, is too small to match seekptr checksum (file=<file_path>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info."

any idea how to resolve this issue?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

crcSalt is very rarely a good option. Usually it's better to raise the initCrcLength if the file has a constant header which may interfere with the file recognition logic.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...