Getting Data In

Problem with Event Duplication

muebel
SplunkTrust
SplunkTrust

I have splunk set up on a few redhat boxes, and I am getting duplicate events from them. One event will list the hostname as the FQDN which is fine, because thats how it is specified in server.conf.

The duplicate event is being indexed as host equal to simply the hostname.

What could be causing this?

Tags (2)
0 Karma

ftk
Motivator

You most likely have the same monitor defined in two configuration files. Run the following command(s) and check for duplicate inputs:

./splunk list monitor
./splunk list tcp
./splunk list udp

muebel
SplunkTrust
SplunkTrust

server.conf probably has nothing to do with this. [default]host= in inputs.conf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...