Getting Data In

Splunk Duplicating IIS Log data

bruceclarke
Contributor

All,

I've recently started forwarding IIS log data to Splunk, and there is at least one file that keeps sending duplicate data. This file is the log file in a W3SVC103 folder. The log file in W3SVC3 is sent without any duplicate data popping up.

I know Splunk hashes the file names in some way to see if there is a new file detected, so my guess is that Splunk occasionally thinks this is a new file. Is there a way to work around this issue? Is it possible that I have some property set up wrong?

I'm just looking for any potential reasons that duplicate events might be being sent.

Thanks,
Bruce

Tags (2)
0 Karma
1 Solution

ekost
Splunk Employee
Splunk Employee

There is an issue that causes duplicate IIS events to appear when using a new feature in Splunk 6.0. The Answers post here: discusses the issue.

View solution in original post

0 Karma

ekost
Splunk Employee
Splunk Employee

There is an issue that causes duplicate IIS events to appear when using a new feature in Splunk 6.0. The Answers post here: discusses the issue.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!