I indexed a 30-line config file off all our Linux hosts. But accidentally used the wrong source-type and index. So I deleted the delete with | delete. Now I need to reindex the file now that I have the correct inputs.conf configured. I thought it would as simple as adding
crcsalt= and I'd be set. But it's not working. Any ideas?
A 30-line config file should be long enough for a 256b CRC - that's just eight byte per line.
Note, configuration keys are case sensitive. Make sure you used
initCrcLength as specified in inputs.conf.
if you just want to ingest this file once off than perhaps oneshot? As per https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI