Why are multiple of the same events and values from a single source file being indexed in Splunk?

[pushpasinghal]

Hi team,

I have a source file like this:

{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.publishHistory.PublishHistoryServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.374","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.kronos.sdm.impl.rest.services.setupItem.SetupItemServiceImpl, request path : \/usermanagement\/v1\/environments"  }
{"ts":"08 26 2015 13:05:41.375","th":"http-bio-8080-exec-1", "level":"DEBUG","logger":"org.apache.cxf.jaxrs.utils.JAXRSUtils","msg":"No resource class match for com.wordnik.swagger.jaxrs.listing.ApiListingResourceJSON, request path : \/usermanagement\/v1\/environments"  }

But while doing a Splunk search, it's showing 8000+ of the same events with same values. As per my observation, while storing data in the index, it is storing it multiple times.

[lukas_loder]

how is the logfile created? Is the newest log at the end of the file?
I had once the same problem, when a Logfile created new Logs always at the first line.

[lukas_loder]

sorry.. but I don't have any further idea...
may go and check this Website
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Editinputs.conf

And things like
followTail =
recursive =

[pushpasinghal]

Whether we add newest at end or beginning, but after parsing it should display logs properly as separate evnets and only three events. Why multiple?

Have you resolved your issue?

[lukas_loder]

something like this
WatchedFile - Will begin reading at offset=0 for file=

or

WatchedFile - Checksum for seekptr didn't match, will re-read entire file=

those aren't Errors. It's are "INFO"

[pushpasinghal]

There are these type of lines but not for my file that is to be indexed. Its for splunk log files

[lukas_loder]

have you checked the logfile on the sourcesystem?
$Splunk$\var\log\splunk\splunkd.log

[pushpasinghal]

yes..but this is not any error so what shall i search in for?