Getting Data In

input monitor all entries double - how to debug?

micm
Explorer

Hi,

I am indexing a directory on a central syslog server. All entries in the index exist exactly two times with a difference in the indexing timestamp of two or three seconds for every pair of identical events.

I already checked that there are no symlinks and the files are not rotated.

[monitor:///var/log/remote]
disabled=false
whitelist=.*(ag|did)\d+_.+$
host_segment=4
sourcetype=syslog
index=messages

How can I continue debugging this problem? As those events never appear more than twice I assume that the recognition of where new syslog entries begin in the files works in general.

0 Karma
1 Solution

micm
Explorer

Sorry, stupid mistake.

I had a second outputs.conf on the forwarder that had the lb group and one member of the group explicitly as targets.

View solution in original post

0 Karma

micm
Explorer

Sorry, stupid mistake.

I had a second outputs.conf on the forwarder that had the lb group and one member of the group explicitly as targets.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...