Getting Data In

How do we get duplicate time values from file?

eholz1
Contributor

Hello All,

I have a file that is created/appended via a bash script (varialbe >> file.txt)

It puts the newest data at the bottom (plan to change that and use python to write file)

The file is monitored by the Universal Forwarder - works fine. BUT when data gets into splunk

I have duplicate date values - the events are a UP or DOWN by hostname with a time recorded for DOWN, and a time recorded for UP.

The search returns duplicate date/time values for each event.. All data goes into the "main" index.

The file has no duplicate time/date values.

Could this be a problem with the sourcetype? should I use  a separate index for the data being monitored?

the file is just a simple text file with date/time, host, and status (UP or DOWN)

Any suggestions?

Thanks so much,

eholz1

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The index name should be specified in the inputs.conf file on the system where the data file is.

Please share the SPL and sanitized output showing the duplicate dates.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, you should use an index other than main, but that is unrelated to your problem.

What search are you using to detect these duplicate times?  If there's only one date in the data then there should be only only one date in Splunk so I wonder if you may be misinterpreting something.

---
If this reply helps you, Karma would be appreciated.

eholz1
Contributor

Hello RichGalloway,

 

Thanks for the reply - I will check the sourcetype. for a "custom" index should I configure the Universal forwarder in its outputs.conf or on the indexer's inputsd.conf?

I am going to try to delete the source type - not sure how to do that - but I will dig around for that.

The file being monitored does not have duplicate dates, etc.

 

Thanks Again,

eholz1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The index name should be specified in the inputs.conf file on the system where the data file is.

Please share the SPL and sanitized output showing the duplicate dates.

---
If this reply helps you, Karma would be appreciated.

eholz1
Contributor

500 karmas to richgallowy - thanks

0 Karma

eholz1
Contributor

Hello,

 

I have to rebuild things now. I will get things going, and post the seaerch, etc here. thanks for the tips

eholz1

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...