Yes. crcSalt is rarely the way to go. The solution is usually to raise the initCrcLength value so that if you have a constant "header" in your file it's getting skipped. As for your original question - there can be several different reasons for it. Try checking output of splunk list monitor and splunk list inputstatus regarding those problematic files ... View more

Ahhh... the SOURCE_KEY part I missed 🙂  Good catch! ... View more