Getting Data In

Events are indexed multiple times

evelenke
Contributor

Hi Splunkers,

we have a lot of files\folders inputs (established on heavy forwarders) and during the last days we've observed substantial increase in indexing volume (even license violation). Analysis reveals re-indexing of events for particular source (4 hosts of the same index and sourcetype) up to 300-700 times during last 2 days (using stats count by _raw) after changing the name of a sourcetype (custom IIS type)
What may cause this behavior and how can I fix it?
Splunk Enterprise 7.2.5

Update: there's the following error: "IndexWriter - The index processor has paused data flow. Too many tsidx files in idx=myindex bucket="$path$/$myindex$/db/hot_v1_714" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised.

0 Karma

tiagofbmm
Influencer

Is someone having fun cleaning up the fishbucket ?

0 Karma

evelenke
Contributor

If only Splunk does

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...