the message I have in the index=_intenal is File will not be read, seekptr checksum did not match (file=\\ntnet\filestore1\information_security$\OS_Security_Splunk\CMI\Tripwire\Compliance Report\Comcast_Ent\15-04-21_Comcast_Ent.csv). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
... View more