Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- File will not be read, seekptr checksum did not ma...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Team
Splunk is unable to read a file which has particular content as below.
If the file contains other content, then splunk is able to get the content. Not sure what is wrong with this content. if the reorder the lines, then also it is able to recognize.
PFB file content.
ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|TOD Ref. Type [IC] not set for scheme [MMSAA]||
ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|There is no transaction for the combination [02-08-2021 00:00:00] and [ M12345]. The posting of transaction failed. Transaction ID: [ M12345]||
ACCNT|AB10012345|1234567890ABC4567890123456789012|INR|C|01-07-2021 00:00:00|30-07-2021 00:00:00|The posting failed.||
Error for this file in splunk logs
ERROR TailReader - File will not be read, seekptr checksum did not match (file=<FullPath_of_file_with file name>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at <website of splunk> for more info.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Files can sometimes have the same few header lines which will confuse Splunk and cause the issue you posted. Add the following line to your monitor stanza in inputs.conf and cycle the forwarder(s).
crcSalt = <SOURCE>
Also ensure that you are using "monitor" for files that update, where "batch" is for historical data that won't change.
More info here:
https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitorfilesanddirectorieswithinputs.conf
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Works as charm. Thanks a lot. It saved me.
BTW Sorry for very late response. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Files can sometimes have the same few header lines which will confuse Splunk and cause the issue you posted. Add the following line to your monitor stanza in inputs.conf and cycle the forwarder(s).
crcSalt = <SOURCE>
Also ensure that you are using "monitor" for files that update, where "batch" is for historical data that won't change.
More info here:
https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitorfilesanddirectorieswithinputs.conf
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ty. Work greate in 2024
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
