https://community.splunk.com/t5/Getting-Data-In/Problem-with-Event-Duplication/m-p/53207#M10267 <P>I have splunk set up on a few redhat boxes, and I am getting duplicate events from them. One event will list the hostname as the FQDN which is fine, because thats how it is specified in server.conf. </P> <P>The duplicate event is being indexed as host equal to simply the hostname.</P> <P>What could be causing this?</P> Sat, 18 Sep 2010 00:43:42 GMT muebel 2010-09-18T00:43:42Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-Event-Duplication/m-p/53207#M10267 <P>I have splunk set up on a few redhat boxes, and I am getting duplicate events from them. One event will list the hostname as the FQDN which is fine, because thats how it is specified in server.conf. </P> <P>The duplicate event is being indexed as host equal to simply the hostname.</P> <P>What could be causing this?</P> Sat, 18 Sep 2010 00:43:42 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-Event-Duplication/m-p/53207#M10267 muebel 2010-09-18T00:43:42Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-Event-Duplication/m-p/53208#M10268 <P>server.conf probably has nothing to do with this. [default]host=<HOSTNAME> in inputs.conf</HOSTNAME></P> Sat, 18 Sep 2010 00:49:08 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-Event-Duplication/m-p/53208#M10268 muebel 2010-09-18T00:49:08Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-Event-Duplication/m-p/53209#M10269 <P>You most likely have the same monitor defined in two configuration files. Run the following command(s) and check for duplicate inputs:</P> <PRE><CODE>./splunk list monitor ./splunk list tcp ./splunk list udp </CODE></PRE> Sat, 18 Sep 2010 00:58:25 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-Event-Duplication/m-p/53209#M10269 ftk 2010-09-18T00:58:25Z