All Apps and Add-ons

Duplicate entries website monitoring

afx
Contributor

Hi,
I am using the 2.9.0 version of Website Monitoring (this was also present in 2.8.0).
Thanks to a huge number inputs to be added, I modified the inputs.conf and restarted splunkd.
Now I see duplicate entries like the following:
alt text

Any ideas what is messed up? Of course there is only one entry in the local inouts.conf file.

EDIT: I also see old entries where I changed the name of the input, they still show up.

thx
afx

0 Karma
1 Solution

jwiedow
Communicator

@afx Try changing your time selector in the dashboard to be for a shorter period of time than the last time you modified it. This is expected behavior due to the change in the stanza name and that the data has been indexed with the old stanza as the source. A raw search of the webping data will prove this out.

Based on your picture above, the duplicate row will disappear if you update your time selector to the last 15 minutes.

View solution in original post

0 Karma

jwiedow
Communicator

@afx Try changing your time selector in the dashboard to be for a shorter period of time than the last time you modified it. This is expected behavior due to the change in the stanza name and that the data has been indexed with the old stanza as the source. A raw search of the webping data will prove this out.

Based on your picture above, the duplicate row will disappear if you update your time selector to the last 15 minutes.

0 Karma

afx
Contributor

Yup, that was the reason.
I was wrongly thinking that the report is based on the definition not the log entries.
thx
afx

0 Karma

nickhills
Ultra Champion

Is there any chance that entry has been mistakenly added in ./default/inputs.conf also?

If my comment helps, please give it a thumbs up!
0 Karma

afx
Contributor

Nope, default only has the user agent definition.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...