Hi
I need to index a small file (2KB) (on Heavy Forwarder )
the file is not indexed
[monitor://\raanana\Tabi4Splunk\TABLEAU_integration_csv\MIS.csv]
disabled = false
index = penetrationtest_mis
sourcetype = csv_current_time
crcSalt =
looks like the issue got resolved with the below configuration
[monitor://\raanana\Tabi4Splunk\TABLEAU_integration_csv\MIS.csv]
disabled = false
index = penetrationtest_mis
sourcetype = csv_current_time
crcSalt =
initCrcLength = 1024
thanks a lot
Please don't forget to select "Accept as a solution" if this reply resolves your query!
if the file has a large header then CRC can be an issue. You may need to set initCrcLength.
try to run this command in elevated command prompt (as admin):
c:\programfiles\splunk\bin\splunk.exe list inputstatus
I think it's not about file size, it's about file specifications.
Can you upload a sample file?
Do you know the specifications of the update?
i have copied the same data few time (file size 12 kb) in the same file and it indexed properly