Index a small file (2 KB)

[rayar]

Hi
I need to index a small file (2KB) (on Heavy Forwarder )
the file is not indexed

[monitor://\raanana\Tabi4Splunk\TABLEAU_integration_csv\MIS.csv]
disabled = false
index = penetrationtest_mis
sourcetype = csv_current_time
crcSalt =

[rayar]

looks like the issue got resolved with the below configuration

[monitor://\raanana\Tabi4Splunk\TABLEAU_integration_csv\MIS.csv]
disabled = false
index = penetrationtest_mis
sourcetype = csv_current_time
crcSalt =
initCrcLength = 1024

thanks a lot

[PavelP]

Please don't forget to select "Accept as a solution" if this reply resolves your query!

[PavelP]

if the file has a large header then CRC can be an issue. You may need to set initCrcLength.

try to run this command in elevated command prompt (as admin):

c:\programfiles\splunk\bin\splunk.exe list inputstatus

[HiroshiSatoh]

I think it's not about file size, it's about file specifications.
Can you upload a sample file?
Do you know the specifications of the update?

[rayar]

i have copied the same data few time (file size 12 kb) in the same file and it indexed properly