Why is Splunk is sending duplicate alerts?

sandeep_salunkh — Thu, 13 Apr 2017 17:23:29 GMT

Hello,

I have configured inputs.conf to monitor the log file on the path. Please find below details regarding same:

We have configured inputs.conf on one centralized server where all data gets dump on hourly basis. It creates a new folder on hourly basis (folder name contains) and it contains log file with specific name.
The file name may or may not get changed every time. So every time you may get the same type of data in the log file. And if there is any new entry it will append to that file.
So path would be like below: C:\Program FIles\AAAA\BBBB\CCCC\Audit*
Setting I did in inputs.conf **[monitor://C:\Program FIles\AAAA*\BBBB\CCCC*] disabled = 0 index = XXXXX sourcetype = XXXXX
I also tried using *crcSalt = *

Problem: Every time it sends whole file to Splunk and getting duplication of alerts. Ideally it should send only new entry which has not already been sent to the indexer.

Re: Why is Splunk is sending duplicate alerts?

valiquet — Sat, 22 Dec 2018 00:11:01 GMT

You should happend the file or create a new file with a new name.

Re: Why is Splunk is sending duplicate alerts?

bhavikbhalodia — Sun, 30 Dec 2018 22:43:25 GMT

Use below additional two options in inputs.conf and check.

[monitor://(file path)]
disabled = 0
index = XXXXX
sourcetype = XXXXX
ignoreOlderThan=(non-negative integer)[s|m|h|d]
alwaysOpenFile = 1

topic Re: Why is Splunk is sending duplicate alerts? in Alerting

Why is Splunk is sending duplicate alerts?

Re: Why is Splunk is sending duplicate alerts?

Re: Why is Splunk is sending duplicate alerts?