Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Universal Forwarder- Duplicate logs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Universal Forwarder- Duplicate logs
I have a Universal Forwarder on Win2008R2. The forwarder is reading Windows logs from a local file and forwarding to Splunk Enterprise. During setup, when prompted for what files to forward and the file path to read from, I selected "Security Logs" and "Forwarded Logs". Unfortunately the forwarder is now reading one event log and forwarding it as two logs; 1 labeled security logs and the other forwarded logs.
My Question is: What file do I need to change to get rid of either "Security Logs" or "Forwarded Logs"? (For example, I looked in $SPLUNK_HOME/etc/system/local/... inputs.conf and outputs.conf but I did not find the configuration in either location.)
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To solve this:
Modify file-
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
All types of logs you don't want as a source should be edited to: "disable = 1"
The above file path is for a default install of Universal Forwarder on Windows2008R2.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On the Splunk indexer, stop the remote inputs for the host.
Remote inputs are from wmi(configured on the indexer), local inputs are local(configured on the forwarder). They are both the same log file(s).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I should have mentioned that you can confirm the duplicates are from using both local and remote sources by looking at the sources. WMI sources will contain 'WMI' in the name, and local ones won't.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think that depends on how they were configured. You will find them in the /etc/apps/someapp/local/wmi.conf file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the default location for remote inputs?
-Thanks
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
