Redundancy in Data Using UF

[tahaahmed354]

I am using a single universal forwarder on my windows machine to send a log file to my Splunk host machine deployed on Ubuntu. 

The problem is that there were 3 logs events initially in the file, and splunk read those events and displayed on the dashboard. But when I appended the same file and added 10 more events manually, the dashboard is giving out 16 log events when there are only 13 events in the log file. its is reading the first three logs twice. How to resolve this issue?  

[inventsekar]

Hi @tahaahmed354 

Looks like you may have mistakenly configured the read from beginning everytime. 

To Troubleshoot this issue, could you please copy paste the inputs.conf from your windows UF (only the required portion is enough, remove any sensitive values), thanks. 

[tahaahmed354]

Sure, here is the configuration of my inputs.conf file

[tcpout:// <ip-address>:<port>]

[monitor://C:\Users\admin\Desktop\practicelogs.txt]

disabled = 0
index = practicelogs
sourcetype = practicelogs


i didnt understand what yo meant by read from beginning. can you please elaborate on that, Thanks.

[inventsekar]

Please add this to your inputs.conf and restart Splunk Service on UF.

crcSalt = <SOURCE>

 and update the test log, then check if the Splunk indexer still have redundant logs. 

regarding the "read from beginning", i was bit confused with the other topic today morning.. monitoring the archive files. more details here:

https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/Monitorfilesanddirectories