https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160651#M32560 <P>That sounds unlikely as long as indexers are working fine. What's the source field of the repeated data? Can you post the input configuration for that source?</P> <P>If your indexers are not working fine and you use <CODE>useAck</CODE> then there is a small chance of duplicates: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Protectagainstlossofin-flightdata#The_possibility_of_duplicates">http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Protectagainstlossofin-flightdata#The_possibility_of_duplicates</A><BR /> ...not regularly every five minutes though, and this would be logged in the forwarder's splunkd.log.</P> Mon, 20 Apr 2015 18:41:30 GMT martin_mueller 2015-04-20T18:41:30Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160649#M32558 <P>We have a batch script which monitors files under some folder and then creates a log file with the file name and file creation time information every 5 mins. Currently, that batch script is creating an empty log file as there are no files in the inspected folder, but there are events coming from that log file to Splunk every 5 minutes. </P> <P>Is it possible that the Splunk forwarder caches old events and re-sends again and again?</P> Mon, 20 Apr 2015 17:55:40 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160649#M32558 sanjay_shrestha 2015-04-20T17:55:40Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160650#M32559 <P>It started at noon and Splunk was getting until 12:55 PM however it stopped after 1 PM. Does this mean anything?</P> Mon, 20 Apr 2015 18:10:52 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160650#M32559 sanjay_shrestha 2015-04-20T18:10:52Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160651#M32560 <P>That sounds unlikely as long as indexers are working fine. What's the source field of the repeated data? Can you post the input configuration for that source?</P> <P>If your indexers are not working fine and you use <CODE>useAck</CODE> then there is a small chance of duplicates: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Protectagainstlossofin-flightdata#The_possibility_of_duplicates">http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Protectagainstlossofin-flightdata#The_possibility_of_duplicates</A><BR /> ...not regularly every five minutes though, and this would be logged in the forwarder's splunkd.log.</P> Mon, 20 Apr 2015 18:41:30 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160651#M32560 martin_mueller 2015-04-20T18:41:30Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160652#M32561 <P>After sending a data block, the forwarder maintains a copy of the data in its wait queue until it receives an acknowledgment. In the meantime, it continues to send additional blocks as usual. If the forwarder doesn't get acknowledgment for a block within 300 seconds (by default), it closes the connection. You can change the wait time by setting the readTimeout attribute in outputs.conf. </P> Fri, 24 Apr 2015 11:58:59 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-that-the-Splunk-forwarder-caches-old-events-and/m-p/160652#M32561 fdi01 2015-04-24T11:58:59Z