topic Re: Why are multiple of the same events and values from a single source file being indexed in Splunk? in Splunk Search

Why are multiple of the same events and values from a single source file being indexed in Splunk?

pushpasinghal — Sun, 30 Aug 2015 12:11:10 GMT

Hi team,

I have a source file like this:

{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.publishHistory.PublishHistoryServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.setupItem.SetupItemServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.375","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.wordnik.swagger.jaxrs.listing.ApiListingResourceJSON, request path : \/usermanagement\/v1\/environments"  }

But while doing a Splunk search, it's showing 8000+ of the same events with same values. As per my observation, while storing data in the index, it is storing it multiple times.

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

lukas_loder — Sun, 30 Aug 2015 17:17:20 GMT

how is the logfile created? Is the newest log at the end of the file?
I had once the same problem, when a Logfile created new Logs always at the first line.

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

pushpasinghal — Mon, 31 Aug 2015 04:30:57 GMT

Whether we add newest at end or beginning, but after parsing it should display logs properly as separate evnets and only three events. Why multiple?

Have you resolved your issue?

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

lukas_loder — Mon, 31 Aug 2015 08:50:29 GMT

have you checked the logfile on the sourcesystem?
$Splunk$\var\log\splunk\splunkd.log

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

pushpasinghal — Mon, 31 Aug 2015 08:52:43 GMT

yes..but this is not any error so what shall i search in for?

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

lukas_loder — Mon, 31 Aug 2015 08:57:28 GMT

something like this
WatchedFile - Will begin reading at offset=0 for file=

WatchedFile - Checksum for seekptr didn't match, will re-read entire file=

those aren't Errors. It's are "INFO"

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

pushpasinghal — Mon, 31 Aug 2015 09:02:19 GMT

There are these type of lines but not for my file that is to be indexed. Its for splunk log files

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

lukas_loder — Mon, 31 Aug 2015 09:05:02 GMT

sorry.. but I don't have any further idea...
may go and check this Website
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Editinputs.conf

And things like
followTail =
recursive =