https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-duplicate-data-coming-from-a-Splunk-Enterprise/m-p/226457#M44230 <P>My first thought was to comment out the first stanza, but I wasn't sure if this could be the cause.<BR /> I will probably try that.</P> <P>thanks for the suggestion.</P> Fri, 15 Jan 2016 17:10:12 GMT jppham 2016-01-15T17:10:12Z https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-duplicate-data-coming-from-a-Splunk-Enterprise/m-p/226455#M44228 <P>I am seeing duplicate events coming from SPLUNK to our external logger.<BR /> external syslog server is 10.1.1.25</P> <P>It appears there are duplicate specs in different stanzas below. Could this be the cause of the duplicate data<BR /> we are seeing?<BR /> [syslog:Everything]<BR /> [syslog:Logger]</P> <P>OUTPUTS</P> <P>[syslog]<BR /> defaultGroup = </P> <P>[syslog:Everything]<BR /> disabled = false<BR /> timestampformat = %b %e %H:%M:%S<BR /> <STRONG>server = 10.1.1.25:514</STRONG></P> <P>[syslog:Logger]<BR /> disabled = false<BR /> timestampformat = %b %e %H:%M:%S<BR /> <STRONG>server = 10.1.1.25:514</STRONG></P> <P>[tcpout]<BR /> maxQueueSize = 500KB<BR /> forwardedindex.0.whitelist = .*<BR /> forwardedindex.1.blacklist = _.*<BR /> forwardedindex.2.whitelist = _audit<BR /> forwardedindex.filter.disable = false<BR /> indexAndForward = false<BR /> autoLBFrequency = 30<BR /> blockOnCloning = true<BR /> compressed = false<BR /> disabled = false<BR /> dropClonedEventsOnQueueFull = 5<BR /> dropEventsOnQueueFull = -1<BR /> heartbeatFrequency = 30<BR /> maxFailuresPerInterval = 2<BR /> secsInFailureInterval = 1<BR /> maxConnectionsPerIndexer = 2<BR /> forceTimebasedAutoLB = false<BR /> sendCookedData = true<BR /> connectionTimeout = 20 <BR /> readTimeout = 300<BR /> writeTimeout = 300 <BR /> useACK = false</P> <H1>defaultGroup=nowhere</H1> Thu, 14 Jan 2016 22:40:49 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-duplicate-data-coming-from-a-Splunk-Enterprise/m-p/226455#M44228 jppham 2016-01-14T22:40:49Z https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-duplicate-data-coming-from-a-Splunk-Enterprise/m-p/226456#M44229 <P>Have you tried commenting one of those two stanzas out, restarting Splunk and seeing what happens?</P> Fri, 15 Jan 2016 03:05:13 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-duplicate-data-coming-from-a-Splunk-Enterprise/m-p/226456#M44229 Richfez 2016-01-15T03:05:13Z https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-duplicate-data-coming-from-a-Splunk-Enterprise/m-p/226457#M44230 <P>My first thought was to comment out the first stanza, but I wasn't sure if this could be the cause.<BR /> I will probably try that.</P> <P>thanks for the suggestion.</P> Fri, 15 Jan 2016 17:10:12 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-duplicate-data-coming-from-a-Splunk-Enterprise/m-p/226457#M44230 jppham 2016-01-15T17:10:12Z