I have a file, service.log, that is configured to be monitored and indexed in Splunk. When checking in Splunk, some of the events in the log file are indexed multiple times.
The Splunk version of my forwarder is 6.5.3.
I have already checked that the events in my log file are unique. Same in inputs.conf with a single entry.
Can someone help advise?
Thank you. Responses are appreciated.
↧