topic Re: If an identical input is specified in inputs.conf for multiple apps on a universal forwarder, will this result in duplicate data? in Getting Data In

If an identical input is specified in inputs.conf for multiple apps on a universal forwarder, will this result in duplicate data?

JdeFalconr — Wed, 24 Feb 2016 22:28:29 GMT

If an input is specified identically in the inputs.conf file of multiple apps running on a Universal forwarder, will the same data be gathered multiple times (and thus generate extra license usage) or just once?

I'm looking at indexed data volume in our Splunk environment for a particular sourcetype within the Splunk App for Microsoft Exchange (winhostmon). In looking at .conf files on one of our Exchange servers' Universal Forwarder, I see that the inputs.conf file within the "TA-Exchange-2010-CAS" app, the "TA-Exchange-2010-HUB" app, and the TA-Windows-2008R2-Exchange-IIS" app all have inputs for "winhostmon" defined precisely the same. None are disabled. Does that mean this data is being gathered and indexed once per application specifying this input? Or is the forwarder smart enough to only gather it once?

Re: If an identical input is specified in inputs.conf for multiple apps on a universal forwarder, will this result in duplicate data?

Jeremiah — Wed, 24 Feb 2016 23:11:40 GMT

Splunk consolidates overlapping input stanzas into a single input, so you should not see the same data indexed multiple times. Keep in mind that is for stanzas that overlap exactly. If there's a variation (ie, similar, but different file paths) then the behavior is different.

Take a look at this doc for information about order of precedence in conf files:

http://docs.splunk.com/Documentation/Splunk/6.1/admin/Wheretofindtheconfigurationfiles

You can list all of the active inputs on your system by using the btool command:

https://answers.splunk.com/answers/11259/how-do-i-list-all-active-input-stanzas-in-all-apps.html

And also with the command:

splunk list monitor

To verify the running configuration on the forwarder.

Re: If an identical input is specified in inputs.conf for multiple apps on a universal forwarder, will this result in duplicate data?

somesoni2 — Wed, 24 Feb 2016 23:46:41 GMT

The Splunk merges configurations/settings from all configurations files based on location-priority. If there are duplicates OR conflicts, it takes the settings from the copy with highest priority. So yes, the forwarder is smart enough that it will gather the data only once if same data input is specified at multiple app/places.

See this link for more information of how splunk configuration file precedence works.
http://docs.splunk.com/Documentation/Splunk/6.3.3/Admin/Wheretofindtheconfigurationfiles