https://community.splunk.com/t5/Getting-Data-In/Events-are-indexed-multiple-times/m-p/383762#M69080 <P>If only Splunk does</P> Wed, 10 Jul 2019 15:36:15 GMT evelenke 2019-07-10T15:36:15Z https://community.splunk.com/t5/Getting-Data-In/Events-are-indexed-multiple-times/m-p/383760#M69078 <P>Hi Splunkers,</P> <P>we have a lot of files\folders inputs (established on heavy forwarders) and during the last days we've observed substantial increase in indexing volume (even license violation). Analysis reveals re-indexing of events for particular source (4 hosts of the same index and sourcetype) up to 300-700 times during last 2 days (using <CODE>stats count by _raw</CODE>) after changing the name of a sourcetype (custom IIS type)<BR /> What may cause this behavior and how can I fix it? <BR /> Splunk Enterprise 7.2.5</P> <P>Update: there's the following error: "IndexWriter - The index processor has paused data flow. Too many tsidx files in idx=myindex bucket="$path$/$myindex$/db/hot_v1_714" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised.</P> Wed, 30 Sep 2020 01:16:40 GMT https://community.splunk.com/t5/Getting-Data-In/Events-are-indexed-multiple-times/m-p/383760#M69078 evelenke 2020-09-30T01:16:40Z https://community.splunk.com/t5/Getting-Data-In/Events-are-indexed-multiple-times/m-p/383761#M69079 <P>Is someone having fun cleaning up the fishbucket ?</P> Wed, 10 Jul 2019 15:13:19 GMT https://community.splunk.com/t5/Getting-Data-In/Events-are-indexed-multiple-times/m-p/383761#M69079 tiagofbmm 2019-07-10T15:13:19Z https://community.splunk.com/t5/Getting-Data-In/Events-are-indexed-multiple-times/m-p/383762#M69080 <P>If only Splunk does</P> Wed, 10 Jul 2019 15:36:15 GMT https://community.splunk.com/t5/Getting-Data-In/Events-are-indexed-multiple-times/m-p/383762#M69080 evelenke 2019-07-10T15:36:15Z