Splunk Duplicating IIS Log data

[bruceclarke]

All,

I've recently started forwarding IIS log data to Splunk, and there is at least one file that keeps sending duplicate data. This file is the log file in a W3SVC103 folder. The log file in W3SVC3 is sent without any duplicate data popping up.

I know Splunk hashes the file names in some way to see if there is a new file detected, so my guess is that Splunk occasionally thinks this is a new file. Is there a way to work around this issue? Is it possible that I have some property set up wrong?

I'm just looking for any potential reasons that duplicate events might be being sent.

Thanks,
Bruce

[ekost · Accepted solution]

There is an issue that causes duplicate IIS events to appear when using a new feature in Splunk 6.0. The Answers post here: discusses the issue.