File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

[santosh_hb]

I am getting the following error due to which, the log file is not getting indexed daily.

Log file name is like: db_20180419.log, db_20180420.log...and so-on (Log rotation file)

File will not be read, seekptr checksum did not match (file=C:.....\test_date.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

So, my question is: do I need to set both "initCrcLen" and "crcSalt" parameters or I can just set "initCrcLen".
In case, I need to set "crcSalt", how to set it for source=C:\logs\db_*.log
Could you help me with an sample for the above source.
regards, Santosh

[santosh_hb]

Thanks guys..Its working.

[xpac]

Then please upvote/accept the answer. 🙂

[xpac]

You could either go with crcSalt or initCrcLen.
As your filenames keep changing, the easiest would be a inputs.conf like this:

[monitor:yourfilename]
crcSalt = <SOURCE>

It will just use the (always different) filename as a salt, so the checksum will differ for each new file - that should solve your problem.
If you had the same issue, but the filename would always be the same, you would have to raise the initCrcLen up to the point where the file is actually different.

[FrankVl]

You might want to put that inputs.conf example as code, now the <SOURCE> setting for the crcSalt dissapears 🙂

[xpac]

Thanks, I missed that and then it ate my precious config. 😉