I have my inputs.conf setup like so:
[monitor:///var/log/java] disabled = 0 index = myindex sourcetype = metrics_csv whitelist = metrics.*.csv CRCSALT = <SOURCE>
But even though each filename is UNIQUE with a timestamp, etc, I still get the error that the "File will not be read"! Thoughts?
ERROR TailReader - File will not be read, is too small to match seekptr checksum (). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.
You'll have to cycle the forwarder after correcting the typo.
Afterwards you can verify with
|tstats count where index=myindex by source
Did this resolve your issue? If so, please accept @richgalloway 's answer so that it can benefit others in the future.