I have index that suddenly stoped indexing data.
even after I entered crcSalt = <SOURCE> to the inputs.conf file data is not indexed anymore
the logs continue to show the following error:
"File will not be read, is too small to match seekptr checksum (file=<file_path>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info."
any idea how to resolve this issue?
crcSalt is very rarely a good option. Usually it's better to raise the initCrcLength if the file has a constant header which may interfere with the file recognition logic.