Getting Data In

duplicate data indexing

shivanandbm
Explorer

i see duplicate data getting indexed.its impacting license. can you please suggest how i can fix this.below is the monitoring .
[monitor:///incoming/XXXXX/XXXX/XXXXX.gz]
disabled = false

whitelist = ..gz

index = XXXXX
sourcetype = XXXX
EVENT_BREAK_ENABLE=true

Tags (1)
0 Karma

MuS
Legend

Please add your outputs.conf to this post.

cheers, MuS

0 Karma

sathwikr076
Communicator

Hi, How many indexers you have and how you are confirming that the duplicate data is ingesting. If those duplicate logs are from same application servers and exactly same in format, Splunk is smart enough to drop the duplicate logs.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...