Splunk Search

Creating local temporary file creates Checksum mismatch

Epicism1
Explorer

Hello,

I'm trying to create an app that runs a script that executes an app, and the app creates a log file that I'm trying to index. The issue is that when I write the log file to a folder in the app I'm getting a Checksum mismatch, which is causing issues. I don't want to use the OS' temporary folder because it needs to be OS neutral (and TMK inputs.conf doesn't allow for %TEMP% type variables), so is there a way to create temporary files within the Splunk directory that are not included in the Checksum verification?

Thank you.

0 Karma
1 Solution

guilmxm
Influencer

Hi,

I would use $SPLUNK_HOME/var/log/

This won't generate the checksum message.

View solution in original post

0 Karma

guilmxm
Influencer

Hi,

I would use $SPLUNK_HOME/var/log/

This won't generate the checksum message.

View solution in original post

0 Karma

Epicism1
Explorer

Brilliant!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!