Splunk Duplicating IIS Log data

bruceclarke — Mon, 16 Dec 2013 23:50:51 GMT

All,

I've recently started forwarding IIS log data to Splunk, and there is at least one file that keeps sending duplicate data. This file is the log file in a W3SVC103 folder. The log file in W3SVC3 is sent without any duplicate data popping up.

I know Splunk hashes the file names in some way to see if there is a new file detected, so my guess is that Splunk occasionally thinks this is a new file. Is there a way to work around this issue? Is it possible that I have some property set up wrong?

I'm just looking for any potential reasons that duplicate events might be being sent.

Thanks,
Bruce

Re: Splunk Duplicating IIS Log data

ekost — Tue, 17 Dec 2013 21:34:22 GMT

There is an issue that causes duplicate IIS events to appear when using a new feature in Splunk 6.0. The Answers post here: discusses the issue.

topic Splunk Duplicating IIS Log data in Getting Data In

Splunk Duplicating IIS Log data

Re: Splunk Duplicating IIS Log data