We are experiencing a massive duplication of events in two log files indexed by Splunk. This started suddenly on a Friday and went on all weekend, resulting in 4 license violations. There are other log files indexed by the same forwarder and they share monitor and other config.
Example of line in the log file:
|2016-09-12 10:59:59,597|DEBUG|HikariCP connection filler (pool HikariPool-0)|HikariPool|After fill pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
In Splunk (event source):
...
|2016-09-12 10:59:59,597|DEBUG|HikariCP connection filler (pool HikariPool-0)|HikariPool|After fill pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,563|DEBUG|Hikari Housekeeping Timer (pool HikariPool-0)|HikariPool|Before cleanup pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,563|DEBUG|Hikari Housekeeping Timer (pool HikariPool-0)|HikariPool|After cleanup pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,597|DEBUG|HikariCP connection filler (pool HikariPool-0)|HikariPool|After fill pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,563|DEBUG|Hikari Housekeeping Timer (pool HikariPool-0)|HikariPool|Before cleanup pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,563|DEBUG|Hikari Housekeeping Timer (pool HikariPool-0)|HikariPool|After cleanup pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,597|DEBUG|HikariCP connection filler (pool HikariPool-0)|HikariPool|After fill pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,563|DEBUG|Hikari Housekeeping Timer (pool HikariPool-0)|HikariPool|Before cleanup pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,563|DEBUG|Hikari Housekeeping Timer (pool HikariPool-0)|HikariPool|After cleanup pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
|2016-09-12 10:59:59,597|DEBUG|HikariCP connection filler (pool HikariPool-0)|HikariPool|After fill pool stats HikariPool-0 (total=20, inUse=3, avail=17, waiting=0)
...
619 events in total for timestamp 2016-09-12 10:59:59,597
Any ideas??
... View more