https://community.splunk.com/t5/Getting-Data-In/Can-symlink-cause-Splunk-to-index-files-twice/m-p/105359#M22198 <P>Due to some inconsistencies in how some of our servers use Symbolic Links (symlinks), we need to understand how Splunk would handle the following situation...</P> <P>/usr2/wlp_logs is a symlink pointing to /hosting/logs.</P> <P>If we have the following 2 monitor stanzas in inputs.conf...</P> <P>[monitor:///usr2/wlp_logs/blah/myapp.log]</P> <P>[monitor:///hosting/logs/blah/myapp.log]</P> <P>...would Splunk recognize that these are 2 references to the same file, and index it only once? Or, would myapp.log get indexed twice?</P> <P>Thx for any clarification / enlightenment.</P> <P>mfeeny1</P> Mon, 07 Nov 2011 19:24:27 GMT mfeeny1 2011-11-07T19:24:27Z https://community.splunk.com/t5/Getting-Data-In/Can-symlink-cause-Splunk-to-index-files-twice/m-p/105359#M22198 <P>Due to some inconsistencies in how some of our servers use Symbolic Links (symlinks), we need to understand how Splunk would handle the following situation...</P> <P>/usr2/wlp_logs is a symlink pointing to /hosting/logs.</P> <P>If we have the following 2 monitor stanzas in inputs.conf...</P> <P>[monitor:///usr2/wlp_logs/blah/myapp.log]</P> <P>[monitor:///hosting/logs/blah/myapp.log]</P> <P>...would Splunk recognize that these are 2 references to the same file, and index it only once? Or, would myapp.log get indexed twice?</P> <P>Thx for any clarification / enlightenment.</P> <P>mfeeny1</P> Mon, 07 Nov 2011 19:24:27 GMT https://community.splunk.com/t5/Getting-Data-In/Can-symlink-cause-Splunk-to-index-files-twice/m-p/105359#M22198 mfeeny1 2011-11-07T19:24:27Z https://community.splunk.com/t5/Getting-Data-In/Can-symlink-cause-Splunk-to-index-files-twice/m-p/105360#M22199 <P>Would like to know this as well.</P> Thu, 09 Jan 2014 22:31:33 GMT https://community.splunk.com/t5/Getting-Data-In/Can-symlink-cause-Splunk-to-index-files-twice/m-p/105360#M22199 cramasta 2014-01-09T22:31:33Z https://community.splunk.com/t5/Getting-Data-In/Can-symlink-cause-Splunk-to-index-files-twice/m-p/105361#M22200 <P>Symbolic links cannot cause splunk to index files twice, unless you make use of crcSalt to force splunk to consider files different via their filenames.</P> <P>Monitoring both the symbolic link and the target of the link is not a good practice however. You will get uncertain behavior as to which name splunk finds the data under.</P> Sat, 11 Oct 2014 07:58:21 GMT https://community.splunk.com/t5/Getting-Data-In/Can-symlink-cause-Splunk-to-index-files-twice/m-p/105361#M22200 jrodman 2014-10-11T07:58:21Z