Skip to main content
Solved

Cribl File Monitor Only Ingesting First File In List Under Same Path

  • Mar 19, 2026 11:07 PM UTC
  • 6 replies
  • 78 views
This message originated from Cribl Community Slack.
Click here to view the original link.

Hi team, I’m configuring a Cribl File Monitor source to ingest multiple files under the same path, but it looks like only the first file in the list is actually being ingested. Has anyone run into this behaviour before? Max Depth is unlimited.

Links for this message:
Screenshot 2026-03-06 at 12.55.56 PM.png

Best answer by dbizon539

Have you confirmed the hash header is different between the files? I think default is the first 256 bytes. You will have to increase it until the hash header is unique
View original

6 replies

  • dbizon539
  • Employee
  • Answer
  • Mar 19, 2026 11:07 PM UTC
Have you confirmed the hash header is different between the files? I think default is the first 256 bytes. You will have to increase it until the hash header is unique
  • dbizon539
  • Employee
  • Mar 19, 2026 11:07 PM UTC
On linux you can do head -c <NUM> filename
  • dbizon539
  • Employee
  • Mar 19, 2026 11:07 PM UTC
You can change the number in Advanced Settings
  • ssharifian672
  • Author
  • New Participant
  • Mar 19, 2026 11:07 PM UTC
Oh the files do have the same header!!
Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • Mar 19, 2026 11:07 PM UTC
Under advanced you can also choose to "salt file hash". This will consider the filename in the creation of the hash. IF the filename is always unique, that could help. If filenames are repeated move along to increasing the has length
  • ssharifian672
  • Author
  • New Participant
  • Mar 19, 2026 11:07 PM UTC
Sweet. Thank you gentlemen :pray:
Terms & ConditionsAccessibility statement