File will not be read, seekptr checksum did not match for a file in splunk

[hariengg]

Hi Team

Splunk is unable to read a file which has particular content as below. 

If the file contains other content, then splunk is able to get the content. Not sure what is wrong with this content. if the reorder the lines, then also it is able to recognize.

PFB file content. 

ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|TOD Ref. Type [IC] not set for scheme [MMSAA]||

ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|There is no transaction for the combination [02-08-2021 00:00:00] and [   M12345]. The posting of transaction failed. Transaction ID: [  M12345]||

ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|The posting failed.||

Error for this file in splunk logs

ERROR TailReader - File will not be read, seekptr checksum did not match (file=<FullPath_of_file_with file name>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at <website of splunk> for more info.

[hariengg]

Works as charm. Thanks a lot. It saved me. 

BTW Sorry for very late response. 🙂 

[codebuilder · Accepted solution]

Files can sometimes have the same few header lines which will confuse Splunk and cause the issue you posted. Add the following line to your monitor stanza in inputs.conf and cycle the forwarder(s).

crcSalt = <SOURCE>

 
Also ensure that you are using "monitor" for files that update, where "batch" is for historical data that won't change.

More info here:
https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitorfilesanddirectorieswithinputs.conf

[hieuba6868]

Ty. Work greate in 2024