Skip to main content
Solved

Cribl File Monitor Only Ingesting First File In List Under Same Path

  • March 19, 2026
  • 6 replies
  • 0 views
S
This message originated from Cribl Community Slack.
Click here to view the original link.

Hi team, I’m configuring a Cribl File Monitor source to ingest multiple files under the same path, but it looks like only the first file in the list is actually being ingested. Has anyone run into this behaviour before? Max Depth is unlimited.

Links for this message:
Screenshot 2026-03-06 at 12.55.56 PM.png

Best answer by dbizon539

Have you confirmed the hash header is different between the files? I think default is the first 256 bytes. You will have to increase it until the hash header is unique

6 replies

D
  • dbizon539
  • Employee
  • Answer
  • March 19, 2026
Have you confirmed the hash header is different between the files? I think default is the first 256 bytes. You will have to increase it until the hash header is unique
D
  • dbizon539
  • Employee
  • March 19, 2026
On linux you can do head -c <NUM> filename
D
  • dbizon539
  • Employee
  • March 19, 2026
You can change the number in Advanced Settings
S
  • ssharifian672
  • Author
  • New Participant
  • March 19, 2026
Oh the files do have the same header!!
Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • March 19, 2026
Under advanced you can also choose to "salt file hash". This will consider the filename in the creation of the hash. IF the filename is always unique, that could help. If filenames are repeated move along to increasing the has length
S
  • ssharifian672
  • Author
  • New Participant
  • March 19, 2026
Sweet. Thank you gentlemen :pray:
Terms & ConditionsAccessibility statement