When I restart Splunk, the rest_ta data inputs trigger a call, even though the polling interval is set to 86400.
Any ideas? My data is getting doubled, tripled, etc simply by restarting the Splunk.
./splunk _internal call /services/apps/local/your_application_name/_reload -auth admin:$ADMINPWD
use above setting and let me know how it goes.
There is not persistent state associated with the poller timing across process restarts.
When you restart Splunk you kill the REST TA process.Ergo , upon restart , the poller starts again.