We have used below monitor in inputs.conf [monitor:///usr/sap/IXP/SYS/profile/DEFAULT.PFL]
disabled = false
sourcetype = defprof
index = erp
crcSalt = defprof
Few days back I could see the full content of this DEFAULT.PFL file in indexer search. Suddenly today when I searched the same its showing only first 4-5 lines of this file.
I checked in somefile.out file, but no errors there.
But when I changed the sourcetype and crcSalt string suddenly I could see the full file content in Indexer. Please let me know what could be the reason for this and why its working after changing the string. This is very strange, kindly help us to fix this issue.
asked 29 Nov '11, 02:43
CRCSALT is used to make files look different to splunk. Without it, splunk loads the first and last 256 bytes and uses that to create a hash which it then compares with other files. If you define CRCSALT, its value is added before the hash is calculated so the file looks different.
What you have done is add a fixed string "defprof" as the CRCSALT. This will make the file look different once. The next time a similar file arrives, it will be ignored again.
If you use "
answered 01 Dec '11, 00:31