Why am I getting error "File will not be read, is too small to match seekptr checksum" trying to parse and index XML data?

[gauravmishra15]

HI friends,

I am trying to index some XML data (size ~ 2-3MB) using Splunk. I've set up a data input to continuously monitor the file location. However, Splunk fails to index/parse any of the XML files. Following error is reported in splunkd.log:

ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=\\share\Integration\partners\gateway\SD-882_834_990ABDX_20160219_085743.xml).  Last time we saw this initcrc, filename was different.  You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.

I am not sure about the reason. Did anyone face this issue?

[shawny2005]

basically change the crd-value and the length it checks.

[puneethgowda]

03-17-2017 12:57:26.944 +0000 ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=D:\HotelHub\Log4NetLogs\109\PH\OHHInfo20170314-07.txt). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

i am also getting this error

[somesoni2 · Accepted solution]

See these post with similar issue and resolution

https://answers.splunk.com/answers/1851/filename-was-different-therefore-source-is-not-indexed-why.h...
https://answers.splunk.com/answers/1568/windows-dhcp-log-files-too-small-to-match-seekptr-checksum.h...

[dw385]

Take a look at crcsalt and initcrclength values for the input config.

http://docs.splunk.com/Documentation/Splunk/6.3.3/admin/Inputsconf

Splunk checks the first 256 bytes of the file to ensure its unique. Since it's an XML file the XML structure is likely using up the entire 256 bytes.