Logs are indexed twice

[strive]

Hi,

We have a simple use case.
1. Place the log file in the directory in forwarder node (LWF node). This directory is monitored for logs.
2. Check if the data is indexed.

I placed a log file with just 3 events. It worked fine. I checked by writing a splunk query(index=my_raw_index) on search page and it displayed 3 records.

I cleaned the index. Placed a log file with 100 events. It worked fine.

I cleaned the index. Placed a log file with 17000 events. When i checked my_raw_index, there were 34000 records.

I tried again with lesser number of events. For lesser events it works fine, but not for the log files with more events. Why it is duplicating the events.

Thanks

Strive

[strive · Accepted solution]

In our case, it was due to file parts. Added blacklist = .(filepart)$ under monitor stanza of inputs.conf file of forwarder node

[strive]

In our case, it was due to file parts. Added blacklist = .(filepart)$ under monitor stanza of inputs.conf file of forwarder node