Why is Splunk is sending duplicate alerts?

[sandeep_salunkh]

Hello,

I have configured inputs.conf to monitor the log file on the path. Please find below details regarding same:

1. We have configured inputs.conf on one centralized server where all data gets dump on hourly basis. It creates a new folder on hourly basis (folder name contains) and it contains log file with specific name.
2. The file name may or may not get changed every time. So every time you may get the same type of data in the log file. And if there is any new entry it will append to that file.
3. So path would be like below: C:\Program FIles\AAAA\BBBB\CCCC\Audit*
4. Setting I did in inputs.conf **[monitor://C:\Program FIles\AAAA*\BBBB\CCCC*] disabled = 0 index = XXXXX sourcetype = XXXXX
5. I also tried using *crcSalt = *

Problem: Every time it sends whole file to Splunk and getting duplication of alerts. Ideally it should send only new entry which has not already been sent to the indexer.

[bhavikbhalodia]

Use below additional two options in inputs.conf and check.

[monitor://(file path)]
disabled = 0
index = XXXXX
sourcetype = XXXXX
ignoreOlderThan=(non-negative integer)[s|m|h|d]
alwaysOpenFile = 1

[valiquet]

You should happend the file or create a new file with a new name.