topic Re: Logs are indexed twice in Splunk Enterprise

Logs are indexed twice

strive — Mon, 28 Sep 2020 13:48:09 GMT

Hi,

We have a simple use case.
1. Place the log file in the directory in forwarder node (LWF node). This directory is monitored for logs.
2. Check if the data is indexed.

I placed a log file with just 3 events. It worked fine. I checked by writing a splunk query(index=my_raw_index) on search page and it displayed 3 records.

I cleaned the index. Placed a log file with 100 events. It worked fine.

I cleaned the index. Placed a log file with 17000 events. When i checked my_raw_index, there were 34000 records.

I tried again with lesser number of events. For lesser events it works fine, but not for the log files with more events. Why it is duplicating the events.

Thanks

Strive

Re: Logs are indexed twice

strive — Mon, 01 Jul 2013 06:32:56 GMT

In our case, it was due to file parts. Added blacklist = .(filepart)$ under monitor stanza of inputs.conf file of forwarder node

Re: Logs are indexed twice

strive — Mon, 01 Jul 2013 06:33:14 GMT

In our case, it was due to file parts. Added blacklist = .(filepart)$ under monitor stanza of inputs.conf file of forwarder node