Splunk Enterprise

TailReader - File will not be read, is too small to match seekptr checksum

gitingua
Communicator
ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=c:\logs\MailBoxAudit\mailboxaudit_23_12_2021_13_48.csv). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.
 
 
inputs.conf
 

/opt/splunk/etc/deployment-apps/TA-Exchange-Mailbox/local/inputs.conf 

[monitor://c:\logs\MailBoxAudit]

whitelist=\.csv$|\.CSV$

sourcetype=csv

index= indexname

disabled=false

crcSalt = <SOURCE>

initCrcLength=8192

after making a change to the file inputs.conf. i ran the command

/opt/splunk/bin/splunk reload deploy-server -class heavy_forwarders

for the changes to be accepted

the file comes to the index, but it does not start up some

 

what could be the problem ?

 

 

 

 
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>