Splunk Search

Splunk skipping indexing of Websphere logs

asherinb
Explorer

We have a case where 4 log files are being monitored.
Daily the log file is rolled to a back up and truncated at the end of the day.

[monitor:///projects/Agent/runtime/logs/websphere1.log]
index=nss
sourcetype=NSS
[monitor:///projects/Agent/runtime/logs/websphere2.log]
index=rts
sourcetype=NSS
[monitor:///projects/Agent/runtime/logs/websphere3.log]
index=nss
sourcetype=NSS
[monitor:///projects/Agent/runtime/logs/websphere4.log]
index=nss

One file or the other gest skipped daily as the data appears same to Splunk.

I tried changing intCRClength to a higher value (around 750 bytes) but that doesnt seem to help either.

Please help in fixing this issue.

Thanks in advance

0 Karma
1 Solution

jeremiahc4
Builder

Have you tried adding crcSalt= to your inputs.conf?

View solution in original post

jeremiahc4
Builder

Have you tried adding crcSalt= to your inputs.conf?

asherinb
Explorer

thanks, adding crcsalt= worked

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...