Getting Data In

In my current batch stanza in inputs.conf, why is the file indexed twice?

xiyangyang
Path Finder

My inputs.conf is as follow:

[batch://C:\Splunk\2.txt]
index = netiq
move_policy = sinkhole
sourcetype = shinsei_db_audit_utf8

[monitor://C:\Splunk\log_SME*.log]
disabled = false
followTail = 0
ignoreOlderThan = 100d
index = netiq
sourcetype = shinsei_common_shift_jis

With this inputs.conf, the batch stanza object 2.txt is indexed twice every time.
If I remove the whole monitor part, the 2.txt is indexed once.

What is the reason of it being indexed twice?

0 Karma

tlam_splunk
Splunk Employee
Splunk Employee

You're using batch stanza, is the file 2.txt deleted after indexing ?

As you mentioned, it's indexed twice, what's the source type of them ? Is it one from shinsei_common_shift_jis and other form shinsei_db_audit_utf8 ?

Thanks

0 Karma

xiyangyang
Path Finder

Yes, the 2.txt was removed after it was indexed.
2.txt is indexed twice, and both of the sourcetype are shinsei_db_audit_utf8.

If I move "" from Line 6, [monitor://C:\Splunk\log_SME.log]. This phenomenon will not happen.

0 Karma

xiyangyang
Path Finder

Yes, the 2.txt was removed after it was indexed.
2.txt is indexed twice, and both of the sourcetype are shinsei_db_audit_utf8.

If I move "" from Line 6, [monitor://C:\Splunk\log_SME.log]. This phenomenon will not happen.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...