Splunk Search

File will not be read, seekptr checksum did not match for a file in splunk

hariengg
Engager

Hi Team

Splunk is unable to read a file which has particular content as below. 

If the file contains other content, then splunk is able to get the content. Not sure what is wrong with this content. if the reorder the lines, then also it is able to recognize.

PFB file content. 

ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|TOD Ref. Type [IC] not set for scheme [MMSAA]||

ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|There is no transaction for the combination [02-08-2021 00:00:00] and [   M12345]. The posting of transaction failed. Transaction ID: [  M12345]||

ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|The posting failed.||

Error for this file in splunk logs

ERROR TailReader - File will not be read, seekptr checksum did not match (file=<FullPath_of_file_with file name>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at <website of splunk> for more info.

0 Karma
1 Solution

codebuilder
Influencer

Files can sometimes have the same few header lines which will confuse Splunk and cause the issue you posted. Add the following line to your monitor stanza in inputs.conf and cycle the forwarder(s).

crcSalt = <SOURCE>

 
Also ensure that you are using "monitor" for files that update, where "batch" is for historical data that won't change.

More info here:
https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitorfilesanddirectorieswithinputs.conf

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

hariengg
Engager

Works as charm. Thanks a lot. It saved me. 

BTW Sorry for very late response. :slightly_smiling_face: 

0 Karma

codebuilder
Influencer

Files can sometimes have the same few header lines which will confuse Splunk and cause the issue you posted. Add the following line to your monitor stanza in inputs.conf and cycle the forwarder(s).

crcSalt = <SOURCE>

 
Also ensure that you are using "monitor" for files that update, where "batch" is for historical data that won't change.

More info here:
https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitorfilesanddirectorieswithinputs.conf

----
An upvote would be appreciated and Accept Solution if it helps!

hieuba6868
Explorer

Ty. Work greate in 2024

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...