Getting Data In

If an identical input is specified in inputs.conf for multiple apps on a universal forwarder, will this result in duplicate data?


If an input is specified identically in the inputs.conf file of multiple apps running on a Universal forwarder, will the same data be gathered multiple times (and thus generate extra license usage) or just once?

I'm looking at indexed data volume in our Splunk environment for a particular sourcetype within the Splunk App for Microsoft Exchange (winhostmon). In looking at .conf files on one of our Exchange servers' Universal Forwarder, I see that the inputs.conf file within the "TA-Exchange-2010-CAS" app, the "TA-Exchange-2010-HUB" app, and the TA-Windows-2008R2-Exchange-IIS" app all have inputs for "winhostmon" defined precisely the same. None are disabled. Does that mean this data is being gathered and indexed once per application specifying this input? Or is the forwarder smart enough to only gather it once?

0 Karma

Revered Legend

The Splunk merges configurations/settings from all configurations files based on location-priority. If there are duplicates OR conflicts, it takes the settings from the copy with highest priority. So yes, the forwarder is smart enough that it will gather the data only once if same data input is specified at multiple app/places.

See this link for more information of how splunk configuration file precedence works.


Splunk consolidates overlapping input stanzas into a single input, so you should not see the same data indexed multiple times. Keep in mind that is for stanzas that overlap exactly. If there's a variation (ie, similar, but different file paths) then the behavior is different.

Take a look at this doc for information about order of precedence in conf files:

You can list all of the active inputs on your system by using the btool command:

And also with the command:

splunk list monitor

To verify the running configuration on the forwarder.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...