Splunk Search
Highlighted

Why are multiple of the same events and values from a single source file being indexed in Splunk?

New Member

Hi team,

I have a source file like this:

{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.publishHistory.PublishHistoryServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.setupItem.SetupItemServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.375","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.wordnik.swagger.jaxrs.listing.ApiListingResourceJSON, request path : \/usermanagement\/v1\/environments"  }

But while doing a Splunk search, it's showing 8000+ of the same events with same values. As per my observation, while storing data in the index, it is storing it multiple times.

0 Karma
Highlighted

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

Communicator

how is the logfile created? Is the newest log at the end of the file?
I had once the same problem, when a Logfile created new Logs always at the first line.

0 Karma
Highlighted

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

New Member

Whether we add newest at end or beginning, but after parsing it should display logs properly as separate evnets and only three events. Why multiple?

Have you resolved your issue?

0 Karma
Highlighted

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

Communicator

have you checked the logfile on the sourcesystem?
$Splunk$\var\log\splunk\splunkd.log

0 Karma
Highlighted

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

New Member

yes..but this is not any error so what shall i search in for?

0 Karma
Highlighted

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

Communicator

something like this
WatchedFile - Will begin reading at offset=0 for file=

or

WatchedFile - Checksum for seekptr didn't match, will re-read entire file=

those aren't Errors. It's are "INFO"

0 Karma
Highlighted

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

New Member

There are these type of lines but not for my file that is to be indexed. Its for splunk log files

0 Karma
Highlighted

Re: Why are multiple of the same events and values from a single source file being indexed in Splunk?

Communicator

sorry.. but I don't have any further idea...
may go and check this Website
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Editinputs.conf

And things like
followTail =
recursive =

0 Karma