Why is some of my log file data indexed multiple times in Splunk?

[arielpconsolaci]

I have a file, service.log, that is configured to be monitored and indexed in Splunk. When checking in Splunk, some of the events in the log file are indexed multiple times.
The Splunk version of my forwarder is 6.5.3.

I have already checked that the events in my log file are unique. Same in inputs.conf with a single entry.
Can someone help advise?

Thank you. Responses are appreciated.

[gcusello]

Hi arielpconsolacion,
show of duplicated events the following fields to debug the problem

• _time,
• _indextime (in human readable format): | eval indextime=strftime(_indextime,"%d/%m/%Y %H.%M.%S"),
• splunk_server (if you have more than one Indexers),
• host. In this way you can check how events are duplicated.

Bye.
Giuseppe

[arielpconsolaci]

Hi @cusello Thank you for your response and advise.

Upon checking, there are several splunk servers (from our cluster) and different index times for each of the duplicated events from the forwarder host.
Sample below.
Splunk Server - Index Times - Raw Event
Splunk Indexer 1 - 9/12/2017 7:50PM - 9/12/2017 7:47PM Arithmetic Exception
Splunk Indexer 2 - 9/12/2017 7:51PM - 9/12/2017 7:47PM Arithmetic Exception
Splunk Indexer 3 - 9/12/2017 7:53PM - 9/12/2017 7:47PM Arithmetic Exception

Can you help advise as to why is this happening, and as to how to resolve this? Thank you and much appreciated.

[gcusello]

Hi arielpconsolacion,
insert in your search also host.
It seems that the same host sends the same log to different indexers.
did you configured your forwarders in autoloadbalancing? https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd
Bye.
Giuseppe

[arielpconsolaci]

Hi @cusello.
Yes, Load balancing has been setup in our forwarders.

Thanks again,
Ariel