A newbie splunker here. I got a doubt about crcsalt as for some reason it's not working for me. I got a task to monitor .conf files for some apps and I made the inputs.conf & props.conf in a server after testing there were some issues so I did crcsalt for it to reindex these files and they did. Now I had to do this again in another server and made an app for it and pushed it to the DX & CM and also towards their respective clusters as well but due to certain circumstances I had to reindex these files with crcsalt the second time but for some reason the files aren't getting reindexed. I changed the sourcetype in props.conf it didn't work still. After foraging through answers.splunk the only answers I got was to clear the fishbucket which is a no go for me, use btprobe which is also a no go or to use crcsalt. Is there any possible way to fix this other than indexing it into a new index? Any help would be appreciated.
↧