Hi team,
I have a source file like this:
{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.publishHistory.PublishHistoryServiceImpl, request path : \/usermanagement\/v1\/environments" }
{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.setupItem.SetupItemServiceImpl, request path : \/usermanagement\/v1\/environments" }
{"ts":"08 26 2015 13:05:41.375","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.wordnik.swagger.jaxrs.listing.ApiListingResourceJSON, request path : \/usermanagement\/v1\/environments" }
But while doing a Splunk search, it's showing 8000+ of the same events with same values. As per my observation, while storing data in the index, it is storing it multiple times.
how is the logfile created? Is the newest log at the end of the file?
I had once the same problem, when a Logfile created new Logs always at the first line.
sorry.. but I don't have any further idea...
may go and check this Website
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Editinputs.conf
And things like
followTail =
recursive =
Whether we add newest at end or beginning, but after parsing it should display logs properly as separate evnets and only three events. Why multiple?
Have you resolved your issue?
something like this
WatchedFile - Will begin reading at offset=0 for file=
or
WatchedFile - Checksum for seekptr didn't match, will re-read entire file=
those aren't Errors. It's are "INFO"
There are these type of lines but not for my file that is to be indexed. Its for splunk log files
have you checked the logfile on the sourcesystem?
$Splunk$\var\log\splunk\splunkd.log
yes..but this is not any error so what shall i search in for?