Splunk Enterprise

TailReader - File will not be read, is too small to match seekptr checksum

gitingua
Communicator
ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=c:\logs\MailBoxAudit\mailboxaudit_23_12_2021_13_48.csv). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.
 
 
inputs.conf
 

/opt/splunk/etc/deployment-apps/TA-Exchange-Mailbox/local/inputs.conf 

[monitor://c:\logs\MailBoxAudit]

whitelist=\.csv$|\.CSV$

sourcetype=csv

index= indexname

disabled=false

crcSalt = <SOURCE>

initCrcLength=8192

after making a change to the file inputs.conf. i ran the command

/opt/splunk/bin/splunk reload deploy-server -class heavy_forwarders

for the changes to be accepted

the file comes to the index, but it does not start up some

 

what could be the problem ?

 

 

 

 
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...