How do we get duplicate time values from file?

[eholz1]

Hello All,

I have a file that is created/appended via a bash script (varialbe >> file.txt)

It puts the newest data at the bottom (plan to change that and use python to write file)

The file is monitored by the Universal Forwarder - works fine. BUT when data gets into splunk

I have duplicate date values - the events are a UP or DOWN by hostname with a time recorded for DOWN, and a time recorded for UP.

The search returns duplicate date/time values for each event.. All data goes into the "main" index.

The file has no duplicate time/date values.

Could this be a problem with the sourcetype? should I use  a separate index for the data being monitored?

the file is just a simple text file with date/time, host, and status (UP or DOWN)

Any suggestions?

Thanks so much,

eholz1

[richgalloway]

Yes, you should use an index other than main, but that is unrelated to your problem.

What search are you using to detect these duplicate times?  If there's only one date in the data then there should be only only one date in Splunk so I wonder if you may be misinterpreting something.

[eholz1]

Hello RichGalloway,

Thanks for the reply - I will check the sourcetype. for a "custom" index should I configure the Universal forwarder in its outputs.conf or on the indexer's inputsd.conf?

I am going to try to delete the source type - not sure how to do that - but I will dig around for that.

The file being monitored does not have duplicate dates, etc.

Thanks Again,

eholz1

[richgalloway · Accepted solution]

The index name should be specified in the inputs.conf file on the system where the data file is.

Please share the SPL and sanitized output showing the duplicate dates.

[eholz1]

500 karmas to richgallowy - thanks

[eholz1]

Hello,

I have to rebuild things now. I will get things going, and post the seaerch, etc here. thanks for the tips

eholz1