All,
I've recently started forwarding IIS log data to Splunk, and there is at least one file that keeps sending duplicate data. This file is the log file in a W3SVC103 folder. The log file in W3SVC3 is sent without any duplicate data popping up.
I know Splunk hashes the file names in some way to see if there is a new file detected, so my guess is that Splunk occasionally thinks this is a new file. Is there a way to work around this issue? Is it possible that I have some property set up wrong?
I'm just looking for any potential reasons that duplicate events might be being sent.
Thanks,
Bruce
There is an issue that causes duplicate IIS events to appear when using a new feature in Splunk 6.0. The Answers post here: discusses the issue.
There is an issue that causes duplicate IIS events to appear when using a new feature in Splunk 6.0. The Answers post here: discusses the issue.