topic Re: Scripted input rlog.sh is indexing multiple same events in Getting Data In

Scripted input rlog.sh is indexing multiple same events

remy06 — Fri, 04 Mar 2011 16:23:52 GMT

I've enabled the script input /opt/splunk/etc/apps/unix/bin/rlog.sh to read audit events.

However I noticed there are duplicated events by having the same session id.

I've checked the actual /var/log/audit/audit.log itself there are only 30 events.However when I do a search in splunk there are 90 events,almost triple.

I've noticed that in splunk there are 3 similar events of the each session id,thus causing the events to triple.

Any idea?

Re: Scripted input rlog.sh is indexing multiple same events

remy06 — Fri, 04 Mar 2011 17:48:04 GMT

Seems to work after following the solution here: http://answers.splunk.com/questions/5650/nix-possible-bug-in-rlog-sh-script

Re: Scripted input rlog.sh is indexing multiple same events

remy06 — Thu, 10 Mar 2011 23:42:11 GMT

The solution provided works nix-possible-bug-in-rlog-sh-script