Hi,
I,am having problem with the configuration inputs.conf file, I'm monitoring remote computer with universal forwarder.
Remote host (monitoring): Ditectory E:SQLAuditLog Files:Audit0001.log.......Audit0010.log Log: ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=E:SQLAuditLogAudit0010.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
The splunk server, Inputs.conf:
[monitor://E:SQLAuditLog]E:SQLAuditLog] crcSalt =
I try, but its not works