Splunk Search

Why are multiple of the same events and values from a single source file being indexed in Splunk?

pushpasinghal
New Member

Hi team,

I have a source file like this:

{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.publishHistory.PublishHistoryServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.setupItem.SetupItemServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.375","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.wordnik.swagger.jaxrs.listing.ApiListingResourceJSON, request path : \/usermanagement\/v1\/environments"  }

But while doing a Splunk search, it's showing 8000+ of the same events with same values. As per my observation, while storing data in the index, it is storing it multiple times.

0 Karma

lukas_loder
Communicator

how is the logfile created? Is the newest log at the end of the file?
I had once the same problem, when a Logfile created new Logs always at the first line.

0 Karma

lukas_loder
Communicator

sorry.. but I don't have any further idea...
may go and check this Website
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Editinputs.conf

And things like
followTail =
recursive =

0 Karma

pushpasinghal
New Member

Whether we add newest at end or beginning, but after parsing it should display logs properly as separate evnets and only three events. Why multiple?

Have you resolved your issue?

0 Karma

lukas_loder
Communicator

something like this
WatchedFile - Will begin reading at offset=0 for file=

or

WatchedFile - Checksum for seekptr didn't match, will re-read entire file=

those aren't Errors. It's are "INFO"

0 Karma

pushpasinghal
New Member

There are these type of lines but not for my file that is to be indexed. Its for splunk log files

0 Karma

lukas_loder
Communicator

have you checked the logfile on the sourcesystem?
$Splunk$\var\log\splunk\splunkd.log

0 Karma

pushpasinghal
New Member

yes..but this is not any error so what shall i search in for?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...