Getting Data In

If an identical input is specified in inputs.conf for multiple apps on a universal forwarder, will this result in duplicate data?


If an input is specified identically in the inputs.conf file of multiple apps running on a Universal forwarder, will the same data be gathered multiple times (and thus generate extra license usage) or just once?

I'm looking at indexed data volume in our Splunk environment for a particular sourcetype within the Splunk App for Microsoft Exchange (winhostmon). In looking at .conf files on one of our Exchange servers' Universal Forwarder, I see that the inputs.conf file within the "TA-Exchange-2010-CAS" app, the "TA-Exchange-2010-HUB" app, and the TA-Windows-2008R2-Exchange-IIS" app all have inputs for "winhostmon" defined precisely the same. None are disabled. Does that mean this data is being gathered and indexed once per application specifying this input? Or is the forwarder smart enough to only gather it once?

0 Karma

Revered Legend

The Splunk merges configurations/settings from all configurations files based on location-priority. If there are duplicates OR conflicts, it takes the settings from the copy with highest priority. So yes, the forwarder is smart enough that it will gather the data only once if same data input is specified at multiple app/places.

See this link for more information of how splunk configuration file precedence works.


Splunk consolidates overlapping input stanzas into a single input, so you should not see the same data indexed multiple times. Keep in mind that is for stanzas that overlap exactly. If there's a variation (ie, similar, but different file paths) then the behavior is different.

Take a look at this doc for information about order of precedence in conf files:

You can list all of the active inputs on your system by using the btool command:

And also with the command:

splunk list monitor

To verify the running configuration on the forwarder.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...