Splunk Enterprise

Why is data not indexed for data input?

mcohen13
Loves-to-Learn

I have index that suddenly stoped indexing data.

even after I entered crcSalt = <SOURCE> to the inputs.conf file data is not indexed anymore

the logs continue to show the following error:

"File will not be read, is too small to match seekptr checksum (file=<file_path>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info."

any idea how to resolve this issue?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

crcSalt is very rarely a good option. Usually it's better to raise the initCrcLength if the file has a constant header which may interfere with the file recognition logic.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...