If an input is specified identically in the inputs.conf file of multiple apps running on a Universal forwarder, will the same data be gathered multiple times (and thus generate extra license usage) or just once?
I'm looking at indexed data volume in our Splunk environment for a particular sourcetype within the Splunk App for Microsoft Exchange (winhostmon). In looking at .conf files on one of our Exchange servers' Universal Forwarder, I see that the inputs.conf file within the "TA-Exchange-2010-CAS" app, the "TA-Exchange-2010-HUB" app, and the TA-Windows-2008R2-Exchange-IIS" app all have inputs for "winhostmon" defined precisely the same. None are disabled. Does that mean this data is being gathered and indexed once per application specifying this input? Or is the forwarder smart enough to only gather it once?
Splunk consolidates overlapping input stanzas into a single input, so you should not see the same data indexed multiple times. Keep in mind that is for stanzas that overlap exactly. If there's a variation (ie, similar, but different file paths) then the behavior is different.
Take a look at this doc for information about order of precedence in conf files:
You can list all of the active inputs on your system by using the btool command:
And also with the command:
splunk list monitor
To verify the running configuration on the forwarder.
The Splunk merges configurations/settings from all configurations files based on location-priority. If there are duplicates OR conflicts, it takes the settings from the copy with highest priority. So yes, the forwarder is smart enough that it will gather the data only once if same data input is specified at multiple app/places.
See this link for more information of how splunk configuration file precedence works.