Splunk Search

Splunk skipping indexing of Websphere logs

asherinb
Explorer

We have a case where 4 log files are being monitored.
Daily the log file is rolled to a back up and truncated at the end of the day.

[monitor:///projects/Agent/runtime/logs/websphere1.log]
index=nss
sourcetype=NSS
[monitor:///projects/Agent/runtime/logs/websphere2.log]
index=rts
sourcetype=NSS
[monitor:///projects/Agent/runtime/logs/websphere3.log]
index=nss
sourcetype=NSS
[monitor:///projects/Agent/runtime/logs/websphere4.log]
index=nss

One file or the other gest skipped daily as the data appears same to Splunk.

I tried changing intCRClength to a higher value (around 750 bytes) but that doesnt seem to help either.

Please help in fixing this issue.

Thanks in advance

0 Karma
1 Solution

jeremiahc4
Builder

Have you tried adding crcSalt= to your inputs.conf?

View solution in original post

jeremiahc4
Builder

Have you tried adding crcSalt= to your inputs.conf?

asherinb
Explorer

thanks, adding crcsalt= worked

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...