Getting Data In

Multiple logs being written per day; only the first log is searchable

bspalding
Engager

I have an application writing multiple log files per day - the files are very similar to each other. The file naming convention is logfile_MM-DD-YYYY_hh-mm.log (e.g. logfile_06-12-2025-11-47.log). 

My universal forwarder is set up like this:

[monitor://E:\path\logfile*.log]
disabled = 0
crcSalt = <SOURCE>
index = XXXX
sourcetype = XXXX
_meta = env::prod-new

The first log file of the day is searchable in Splunk, but every file after that is not visible.


I have tried using logfile_*.log as the file name. I have also tried without the crcSalt command, but I'm not seeing any difference. 

Any suggestions?

Labels (1)
0 Karma
1 Solution

Prewin27
Contributor

@bspalding 

Use initCrcLength if your files are extremely similar at the start and the UF is getting confused

Eg:
Note-Change initCrcLength value based on your similar header size

[monitor://E:\path\logfile*.log]
disabled = 0
initCrcLength = 256
crcSalt = <UNIQUESOURCE>
index = XXXX
sourcetype = XXXX
_meta = env::prod-new


Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

View solution in original post

0 Karma

Prewin27
Contributor

@bspalding 

Use initCrcLength if your files are extremely similar at the start and the UF is getting confused

Eg:
Note-Change initCrcLength value based on your similar header size

[monitor://E:\path\logfile*.log]
disabled = 0
initCrcLength = 256
crcSalt = <UNIQUESOURCE>
index = XXXX
sourcetype = XXXX
_meta = env::prod-new


Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do the files have a common header?  If so, you may need to set initCrcLength to a value larger than the header.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...