Splunk Enterprise

Why is data not indexed for data input?

mcohen13
Loves-to-Learn

I have index that suddenly stoped indexing data.

even after I entered crcSalt = <SOURCE> to the inputs.conf file data is not indexed anymore

the logs continue to show the following error:

"File will not be read, is too small to match seekptr checksum (file=<file_path>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info."

any idea how to resolve this issue?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

crcSalt is very rarely a good option. Usually it's better to raise the initCrcLength if the file has a constant header which may interfere with the file recognition logic.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...